ShinyHunters said it held data “on almost ALL FBI Agents. In May, the FBI published a warning about ShinyHunters and told the gang’s victims...
 |
| ShinyHunters said it held data “on almost ALL FBI Agents. |
The group posted its statement on its dark-web leak site and repeated the story in an online chat with journalists. It framed the attack as retaliation. The FBI’s May announcement had laid out ShinyHunters’ methods and urged targets to refuse ransom demands.
The boast went far beyond one website. ShinyHunters said it held data “on almost ALL FBI Agents, and individuals who filed an application with the FBI for a job.” The bureau kept its reply brief. The FBI said it “is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”
What the Leaked Contains
The hackers offered two pieces of evidence. One was a screenshot of what they said was a vandalized FBI job site. The other was a data set on roughly 5,000 agents, which they described as a slice of a much larger haul. Nobody could authenticate the screenshot. Still, the job site had clearly hit trouble. A notice posted Tuesday said both the site and the FBI “Special Agent Applicant Portal” were “currently unavailable.”
The sample looked far more dangerous than a defaced page. It appeared to list agents’ names, home addresses, Social Security numbers and assignments. Some entries also named family members. Journalists ran the details against credit bureau records and older breach data preserved by dark-web intelligence firm District 4 Labs. At least 10 entries appeared to match, including Patel’s. A person familiar with the matter said job descriptions in the data also lined up in some cases.
That is not proof of an FBI breach. No one has shown where the data came from, or whether it left the bureau’s internal systems as the hackers claim. Attempts to reach people named in the sample went unanswered.
Why Exposed Agents
Cynthia Kaiser, a former FBI official, called breaches like this one “incredibly harmful.” Criminals can use such records to expose the people investigating them and to put pressure on them personally. Kaiser, now senior vice president at cybersecurity firm Halcyon, pointed to a 2016 leak that still turns up in harassment of agents today. “Once that information is stolen, it is used forever,” she said. The group’s own record makes that risk concrete. The FBI’s May advisory said ShinyHunters pressures victims and their relatives with threatening calls and texts, and in some cases with swatting.
ShinyHunters is among the most notorious and publicity-hungry hacking groups active today. It claims to have stolen millions of business records from Rockstar Games, the studio behind “Grand Theft Auto.” In May, an intrusion centered on the Canvas education platform disrupted schools across the United States.
The gang has not slowed down. Earlier this month, Anthropic said it caught ShinyHunters-linked hackers trying to use its AI tools. On Sunday, the group declared war on rival crew cl0p, a rare public round of score-settling between cybercriminals.
The group has also described its way in. It says it breached an Oracle PeopleSoft server, software that HR teams and recruiters use to store applicant details, and then pivoted into an Amazon-hosted government cloud that held agent and applicant records. It also claimed it used a PeopleSoft zero-day to seize the jobs page, the same software ShinyHunters abused in its campaign against more than 100 organizations in June. The hackers insist the FBI attack is “not financially motivated” and want the bureau to withdraw its May report.
The episode also tests the “don’t pay” advice at the heart of that report. After the Canvas breach, parent company Instructure reached a deal with the hackers a day before their May 12 deadline, following claims that data tied to thousands of schools had been taken. Organizations facing the same crew should prepare a plan for what to do after a data breach, and invest in enterprise security suites that catch intruders early. The bigger problem is that cybersecurity risk keeps getting harder to manage when attackers treat public warnings as a dare.
