The FBI is investigating an alleged FBIJobs.gov breach after the cybercriminal group ShinyHunters claimed it stole sensitive information belonging to thousands of bureau employees and job applicants.
The FBI confirmed Wednesday that it was investigating unauthorized activity involving FBIJobs.gov, the bureau’s primary website for people seeking employment with the agency. The site remained offline Wednesday.
“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information,” the bureau said.
The political news that affects your wallet, your rights and your vote, broken down in plain language. Free in your inbox.
The FBI said investigators had not yet determined whether the breach originated with the bureau or one of the third-party companies that support the jobs portal.
“While the point of breach is still undetermined,” the FBI said, it was “actively and aggressively investigating this matter” and working with third-party providers to mitigate potential risks.
Hackers claim access to FBI personnel data
ShinyHunters claimed responsibility for the intrusion in a message posted online Tuesday. The group said it had compromised FBIJobs.gov and obtained what it described as highly sensitive information on “almost ALL FBI Agents” and people who had applied for jobs with the bureau.
The claims could not initially be fully verified by the FBI. Reuters reported that the group claimed to have breached the bureau and stolen data involving a large number of current and former employees.
But cybersecurity news outlet 404 Media reported that it had reviewed a sample of about 5,000 purported FBI employee records that included names, addresses, phone numbers and information about employees’ spouses. Recorded Future News separately reported that several news organizations reviewed samples and confirmed that some of the records appeared legitimate.
The apparent legitimacy of some records does not establish the full scope of the breach or confirm all of ShinyHunters’ claims about what it obtained.
The group directed its message to FBI Director Kash Patel and Brett Leatherman, the bureau’s assistant director overseeing its Cyber Division.
Hackers demand removal of FBI warning
ShinyHunters said it would give the FBI seven days to remove or correct statements in a May public advisory that described the organization as a cybercriminal group specializing in large-scale data breaches and extortion.
In that advisory, the FBI warned that ShinyHunters had a history of making claims about stolen information that could be exaggerated or false. The bureau said the group sometimes uses purported access to sensitive information to pressure victims into paying and may falsely claim to possess embarrassing or compromising material.
ShinyHunters disputed those descriptions, saying the FBI’s advisory had mischaracterized its activities.
The group said its demand was not an extortion attempt and did not specify what it would do if the FBI refused to remove the advisory.
Why the alleged breach is significant
The FBIJobs.gov system handles information submitted by people seeking employment with the bureau. A Justice Department privacy assessment says the FBI’s Candidate Gateway system collects significant personally identifiable information from applicants and that unauthorized disclosure could compromise the identities of people applying for FBI positions.
The system’s privacy assessment says applicant information is protected through access controls and encryption, with application-related personal information periodically purged from the database.
If information belonging to current or former agents was also obtained, the potential consequences could extend beyond ordinary identity theft. FBI personnel can work on sensitive investigations and operations, making personal information potentially valuable to criminal or foreign intelligence groups.
Cybersecurity experts cited by Recorded Future News warned that stolen information involving FBI personnel could potentially be used for financial fraud, threats against employees and their families, or targeted cyberattacks.
FBI has faced other cyber incidents
The alleged jobs-site breach is the latest in a series of cyber incidents involving the FBI this year.
In March, the bureau said it was investigating suspicious activity involving an internal system containing sensitive information related to surveillance operations and investigations.
That same month, a pro-Iranian hacking group claimed to have compromised an account belonging to Patel. The group published photographs, a résumé and other documents that appeared to date back years. The FBI characterized the exposed information as historical and said it did not involve government information.
The bureau has also been increasingly focused on ShinyHunters. Leatherman recently said the FBI was focused on the group because of its role in data-exfiltration and extortion attacks. Recorded Future News reported that the group has been linked to attacks involving major companies and organizations.
Investigation continues
For now, the FBI has not publicly confirmed the full extent of the alleged compromise or identified the specific vulnerability that allowed unauthorized access.
The bureau’s statement also leaves open whether the intrusion occurred within FBI systems or through a third-party provider supporting FBIJobs.gov.
The jobs portal remained unavailable Wednesday as investigators and outside providers worked to assess the incident.
The central questions now are how the attackers gained access, what information was actually obtained and whether any current or former FBI personnel face a continuing security or privacy risk.
