FBI confirms data theft from job portal

The Federal Bureau of Investigation told agents and support staff that hackers stole their personal information in a cyberattack targeting the bureau's job application portal.

What data was exposed in the breach

The FBI declared a cyber security incident after confirming that names, addresses, job titles and Social Security numbers of employees were exposed in the hack.

Medical records also stolen

Several media outlets confirmed that stolen data included medical information such as blood and urine sample records as well as psychiatric reports from FBI employees.

ShinyHunters claims broad access

The hacking group ShinyHunters told TechCrunch they have data on mostly all of FBI and a substantial amount of information on applicants through the FBIJobs.gov portal.

“have data on mostly all of FBI”

How hackers broke into the system

ShinyHunters exploited a vulnerability in an Oracle PeopleSoft server that hosts human resources information on agents and former employees who applied through the portal.

Hackers demand FBI correct a report

ShinyHunters told TechCrunch they are not seeking financial ransom but are demanding the FBI correct an earlier report which they say misrepresents their activities.

National security expert warns of risks

Justin Sherman, a national security expert, called the breach a counterintelligence disaster that would expose thousands of FBI personnel to profiling, phishing and foreign intelligence approaches.

“counterintelligence disaster”

Congress notification unclear

It remains unclear whether the FBI has disclosed the incident to Congress, which federal law requires when a breach involves personally identifiable information likely to result in demonstrable harm to national security.