Exclusive: Stolen FBI Data Exposes Sensitive Intelligence Roles, Reuters Finds
By Raphael Satter and AJ Vicens
WASHINGTON, Sept 23 (Reuters) - A spreadsheet allegedly stolen from the FBI by the cybercriminal group ShinyHunters contains unusually detailed information about the assignments of dozens of bureau officials, including work on Chinese espionage, Russian intelligence, drug cartels and other sensitive targets, Reuters has found.
The 5,000-line file — which the hackers describe as a small sample of a claimed two- to three-terabyte haul — lists names, addresses, phone numbers, dates of birth, Social Security numbers and emergency contacts for what they say are thousands of current and former FBI employees. It also identifies assignments to specific field offices and, in some cases, to units handling high-stakes intelligence, security or counterespionage work.
The FBI said in a statement that it was aware of “a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information.” The bureau said the cause of the breach had not been determined and that it was “actively and aggressively investigating the matter.”
ShinyHunters said Tuesday that it had breached the FBI and stolen data on a large number of current and former employees. The group said it was holding the data hostage until the bureau retracts an unflattering statement it issued about the hackers in May.
Eric O’Neill, a former FBI counterintelligence operative, called the allegedly stolen data “a foreign intelligence service goldmine.”
“China would be incredibly interested to know the individuals who are working against it,” said O’Neill, who founded the cybersecurity company Nexasure AI after leaving the bureau. He predicted that other hostile intelligence services would also seek the data, along with disgruntled extremists in the United States.
“If I were on that list I would be very concerned,” he said.
ShinyHunters said in a statement Wednesday that it was trying to prevent the personnel information from circulating widely in the meantime.
“If the 5,000 sample data records leak, it’s not because of us,” the group said.
Reuters has not been able to authenticate the entire spreadsheet. But the news agency individually verified details for more than 22 people by cross-referencing the hacked data with credit records and previous leaks catalogued by the dark web intelligence platform District 4 Labs.
The apparent breach underscores the risks posed by data-extortion crews that target government agencies and private companies, and the potential national-security consequences when employee data includes operational details. If authenticated, such information could help foreign intelligence services identify staff with sensitive portfolios, enabling targeted recruitment, surveillance, phishing or blackmail attempts. It could also force the FBI to adjust assignments or security protocols and make partners and sources more cautious.
Counterterrorism, counterintelligence and surveillance
Some assignment details in the ShinyHunters data are no more revealing than what employees might disclose publicly, such as work at field offices in Baltimore or Newark, New Jersey.
But other entries refer to FBI units or initiatives that are sensitive, or whose existence had not previously been disclosed.
The data names 14 staffers focused on China-related matters, including members of the “China criminal enterprise unit,” the “China tech transfer analysis unit” and the “China intelligence section.”
Nine others are listed in Russia-related roles, including two in the “Russia Operations Section” and one working on “Russia Critical Infra and Tech Threat.” Three people are listed as working in Iran- or Hezbollah-focused intelligence roles.
Eighteen others are listed as working with “data intercept” or “telecom intercept” technologies, or in the FBI’s “clandestine technical operations” unit, its “covert access section,” or in video, audio or electronic surveillance roles.
A further 11 FBI staffers are listed in HUMINT, or human intelligence, jobs, including several in the “Humint program management section.”
Trevor Hilligoss, a former Army investigator who worked with the FBI, said the information linking named individuals to human intelligence work was particularly troubling.
“You don’t have to look far to find examples of undercover agents being harmed when their cover is blown,” he said.
Hilligoss, now chief intelligence officer for the cybersecurity company SpyCloud, said his concerns were heightened by the inclusion of emergency contacts — often spouses or children — “who may have less operational security knowledge than their relative that works in a sensitive field.”
Reuters could not verify that all the job assignments were authentic or current. It was able to match the career details or titles of eight people whose data was leaked with information in court filings, news articles, public LinkedIn profiles or online posts on sites such as Instagram.
Other targets
ShinyHunters has previously claimed credit for the purported theft of millions of business records from Rockstar Games, the maker of “Grand Theft Auto,” and for an intrusion involving the education tool Canvas that caused widespread disruption across U.S. schools.
In May, the FBI said ShinyHunters sometimes used “exaggerated claims of access to sensitive or personal information to prompt payment from victims.”
ShinyHunters said its “threats and claims are very real,” adding that the FBI’s statement was why it targeted the bureau.
Reuters has not been able to verify what else the hackers are holding. ShinyHunters previously told Reuters it obtained files related to the vetting of employees and applicants, the contracting of background investigations and agents’ sensitive medical data, but said Wednesday it would not release any further data.
O’Neill, the former FBI operative, cautioned against drawing conclusions about what the hackers possess.
“They’re really trying to scare the hell out of the FBI,” he said.
(Reporting by Raphael Satter and AJ Vicens; editing by Chris Sanders and David Gaffen)