FBI investigates alleged theft of ‘very sensitive’ employee data

ShinyHunters hackers claim to have stolen data on thousands of FBI employees as the agency probes a portal breach.

A tour bus drives past the FBI headquarters in Washington, DC, US on February 3, 2025 [File: Kevin Lamarque/Reuters]

The United States Federal Bureau of Investigation says it is investigating a breach of its jobs website by a hacking group that claims to have obtained sensitive data on thousands of employees.

“The FBI is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information,” the agency said in a statement on Wednesday.

list 1 of 3 FBI director Kash Patel’s emails, photos hacked by Iran-linked group

list 2 of 3 FBI Director Kash Patel sues Atlantic for ‘false’ reporting on drinking

list 3 of 3 FBI’s Kash Patel defends hiring policy change on bestiality, prostitution

“While the point of breach is still undetermined — whether a third -party or the FBI’s enterprise — we are actively and aggressively investigating this matter and working closely with those third-party providers that support fbijobs.gov to mitigate any and all risk.”

Several news outlets, including Reuters news agency, reported they had seen parts of the data, claimed to be part of a larger trove between two and three terabytes by ShinyHunters, a hacking group claiming responsibility for the breach. According to Reuters, the data includes granular detail about scores of bureau officials’s job assignments, including sensitive work against Chinese spies, Russian intelligence, drug cartels and more.

ShinyHunters said on Tuesday that it had breached the FBI and stolen data on a huge number of current and former FBI employees. ⁠⁠It said it is holding the data hostage until the bureau rescinds an unflattering statement about the group issued in May. On Wednesday, the group said it was trying to keep the ⁠⁠personnel information from circulating widely in the meantime.

An FBI statement in May characterised ShinyHunters as “threat actors” who often harass or threaten victims, using “their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims”.

The group “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist,” the FBI said.

The FBI has been a common hacking target.

In March, the FBI disclosed that it was investigating “suspicious activities” on an internal system that contains sensitive information related to surveillance operations and investigations. Also that month, a pro-Iranian hacking group claimed to have hacked an account of FBI Director Kash Patel and posted online what appear to be years-old photographs of him, along with a work resume and other personal documents dating back more than a decade.

The jobs portal was still offline Wednesday afternoon.

ShinyHunters 黑客声称窃取了数千名 FBI 员工的数据，而 FBI 正在调查一起门户网站入侵事件。

2025年2月3日，一辆旅游巴士驶过位于美国华盛顿特区的联邦调查局总部。[图片：Kevin Lamarque/路透社]

美国联邦调查局表示，他们正在调查一起黑客组织入侵其招聘网站的事件，该组织声称已获取数千名员工的敏感数据。

“联邦调查局注意到一个网络犯罪集团声称已入侵 fbijobs.gov 门户网站，并声称对联邦调查局员工的个人身份信息造成了影响，”该机构周三在一份声明中表示。

伊朗关联组织黑客组织窃取了FBI局长卡什·帕特尔的三封电子邮件和照片，以下列出其中第一封。

（共3条，此为第2条）FBI局长卡什·帕特尔起诉《大西洋月刊》关于饮酒问题的“虚假”报道

名单3/3：FBI探员卡什·帕特尔为有关兽交和卖淫的招聘政策变更辩护

“虽然目前尚无法确定违规点——是第三方还是FBI自身——但我们正在积极主动地调查此事，并与支持fbijobs.gov的第三方供应商密切合作，以降低任何风险。”

包括路透社在内的多家新闻媒体报道称，他们已看到部分数据，据称这些数据只是黑客组织ShinyHunters泄露的2至3TB数据的一部分。该组织声称对此次数据泄露事件负责。路透社报道称，这些数据包含数十名联邦调查局官员工作安排的详细信息，其中包括针对中国间谍、俄罗斯情报机构、贩毒集团等敏感任务。

ShinyHunters周二声称已入侵FBI系统，窃取了大量现任和前任FBI雇员的数据。该组织表示，他们将扣押这些数据，直到FBI撤回5月份发布的一份对该组织不利的声明。周三，该组织表示，他们正在努力阻止这些人事信息在此期间被广泛传播。

FBI 在 5 月份的一份声明中将 ShinyHunters 描述为“威胁行为者”，他们经常骚扰或威胁受害者，利用“他们真实或夸大的说法，声称可以访问敏感或个人信息，以此来诱使受害者付款”。

美国联邦调查局表示，该团伙“可能会谎称拥有敏感或有损受害者形象的信息，包括令人尴尬的照片或视频，而这些信息往往并不存在”。

美国联邦调查局一直是黑客攻击的常见目标。

今年3月，联邦调查局披露，正在调查一个内部系统中的“可疑活动”，该系统包含与监视行动和调查相关的敏感信息。同月，一个亲伊朗的黑客组织声称入侵了联邦调查局局长卡什·帕特尔的账户，并在网上发布了一些看似是多年前拍摄的帕特尔照片，以及一份工作简历和其他一些个人文件，这些文件的历史可以追溯到十多年前。

周三下午，招聘网站仍然无法访问。