ShinyHunters claims to have compromised FBI services and to possess personal data on thousands of the agency’s employees and candidates

The hacker group ShinyHunters claims to have compromised several services associated with the Federal Bureau of Investigation (FBI) and obtained personal data on the agency’s employees and applicants. The information was presented to 404 Media by a group representative, who said the attack took place on the evening of Monday, September 21.

The hackers provided a data sample concerning approximately 5,000 FBI employees. The dataset allegedly includes names, addresses, phone numbers and dates of birth, as well as, in some cases, information about family members. Journalists verified some of the numbers using OSINT tools and identified links to people with similar surnames. Some of the data was also linked to employees of the U.S. Department of Justice.

ShinyHunters claims to have also compromised the FBI’s recruitment website, where it allegedly displayed a message claiming responsibility for the attack. The group says it exploited a zero-day vulnerability in an Oracle PeopleSoft product and accessed AWS GovCloud servers, from which it allegedly downloaded between two and three terabytes of data.

The FBI had not publicly confirmed the scope of the incident by the time of reporting. ShinyHunters is known for attacks followed by threats to publish stolen data, but its representative claims that the operation against the FBI was not financially motivated.