FBI data allegedly stolen by the hacker group ShinyHunters contain granular details about the assignments of dozens of agency employees, including sensitive work related to Chinese spies, Russian intelligence services, drug cartels and other fronts of operation, according to Reuters.
The 5,000-line spreadsheet — which, according to the hackers, represents only a small portion of the two to three terabytes they claim to possess — includes names, addresses, phone numbers, dates of birth, social security numbers and emergency contacts of what they say are thousands of FBI employees. The material also consolidates information about postings in specific regional offices and, in some cases, in units responsible for intelligence, security and counterintelligence activities.
In a statement, the FBI said it was aware of “a cybercriminal group that claims to have breached the FBIJobs.gov portal and of a supposed impact on FBI employees’ personal identification information.” The agency added that the cause of the breach had not yet been determined, but that it is “actively and aggressively investigating the case.”
The hackers claimed on Tuesday to have breached the FBI and stolen data from a large number of current and former agency employees. The ShinyHunters group said it was holding the data hostage until the FBI withdraws a statement about the group issued in May.
Former FBI counterintelligence agent Eric O’Neill said that the data allegedly stolen would be “a gold mine for foreign intelligence services.”
“China would have enormous interest in knowing who the people working against it are,” said O’Neill, founder of the cybersecurity company Nexasure AI after his time with the FBI. He said that other hostile intelligence services and even dissatisfied extremists in the United States would also be interested in obtaining the information.
“If I were on that list, I would be very concerned,” he said.
The ShinyHunters stated in a press release issued on Wednesday that it is trying to prevent personal information from circulating broadly.
“If the 5,000 records in the sample leak, it will not be our fault,” the group said.
While Reuters could not authenticate the entire spreadsheet, the agency individually verified the data of more than 22 people, cross-checking the leaked information with credit records and other leaks previously disclosed by the District 4 Labs dark web intelligence platform.
Counterterrorism, Counterintelligence and Surveillance
Part of the roles cited in the ShinyHunters data correspond to activities the employees themselves could publicly mention, such as work at FBI regional offices in Baltimore or Newark, New Jersey. Other records refer to areas widely known, such as the Internet Crime Complaint Center and the FBI Academy in Quantico, Virginia.
In some cases, however, the data refer to FBI units or initiatives that were confidential or whose existence had not previously been disclosed.
The records mention 14 employees dedicated to topics related to China, including members of the “China Criminal Organizations Unit,” the “China Technology Transfer Analysis Unit,” and the “China Intelligence Section.”
Nine others appear in roles related to Russia, including two members of the “Russia Operations Section” and a professional working on “Threats to Russia’s Critical Infrastructure and Technology.” Three people are described as working in intelligence activities targeting Iran or Hezbollah.
Another 18 employees are tied to technologies involving “data interception” or “telecommunications interception,” to the FBI’s “clandestine technical operations” unit, to the “secret access section” or to video, audio and electronic surveillance activities.
Eleven more employees are associated with HUMINT roles, including professionals linked to the “Humint Program Management Section.”
Trevor Hilligoss, a former Army investigator who worked with the FBI, said that the information linking people named to HUMINT operations is particularly concerning.
“You don’t have to look far to find examples of undercover agents who paid the price after their identities were exposed,” he said.
Hilligoss, currently the head of intelligence at the cybersecurity company SpyCloud, said his concerns are heightened by the presence of emergency contacts — often spouses or children — who may have less knowledge of operational security procedures than relatives involved in sensitive activities.
Reuters could not confirm whether all job assignments were authentic or up to date. Still, it cross-checked the professional information of eight people named in the leak against court documents, news reports, public LinkedIn profiles and posts on social media, such as Instagram.
