FBI data allegedly stolen by the hacking group ShinyHunters carries granular detail about scores of bureau officials’ job assignments, including sensitive work against Chinese spies, Russian intelligence, drug cartels, and more, Reuters has found.
The 5,000-line spreadsheet – said by the hackers to represent only a small piece of their claimed two- to three-terabyte trove – includes names, addresses, telephone numbers, dates of birth, social security numbers, and emergency contact details for what they claimed were thousands of FBI employees. It also includes details of assignments to specific field offices and, in some cases, to units engaged in high-stakes intelligence, security, or counterespionage work.
In a statement, the FBI said it was aware of “a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information.” The bureau said the cause of the breach was still undetermined, but that it was “actively and aggressively investigating the matter.”
The hackers said on Tuesday that they had breached the FBI, stealing data on a large number of current and former FBI employees. ShinyHunters said it is holding the data hostage until the bureau rescinds an unflattering statement, opens new tab about the group issued in May.
Former FBI counterintelligence operative Eric O’Neill said the data allegedly stolen by ShinyHunters was “a foreign intelligence service goldmine.”
“China would be incredibly interested to know the individuals who are working against it,” said O’Neill, who founded the cybersecurity company Nexasure AI after his stint at the bureau. He predicted that other hostile intelligence services would be eager to get their hands on the data, along with disgruntled extremists in the United States.
“If I were on that list I would be very concerned,” he said.
ShinyHunters said in a statement Wednesday that it was trying to keep the personnel information from circulating widely in the meantime.
“If the 5,000 sample data records leak, it’s not because of us,” the group said.
Although Reuters has not been able to authenticate the entire spreadsheet, it has been able to individually verify the details of more than 22 people by cross-referencing information in the hacked data with credit records and previous data leaks carried by the dark web intelligence platform District 4 Labs.
COUNTERTERRORISM, COUNTERINTELLIGENCE AND SURVEILLANCE
Some of the assignment details in the ShinyHunters’ data are indistinguishable from what employees themselves might say publicly, noting agents at field offices in Baltimore or Newark, New Jersey, for example.
But in some cases, the data referred to FBI units or initiatives that were sensitive or whose existence has not previously been disclosed.
The data names 14 staffers focused on China-related matters, including members of the “China criminal enterprise unit,” the “China tech transfer analysis unit,” and the “China intelligence section.”
Nine others are listed as serving in Russia-related roles, including two in the “Russia Operations Section” and one working on “Russia Critical Infra and Tech Threat.” Three people are listed as working in Iran- or Hezbollah-focused intelligence roles.
Eighteen others are listed as working with “data intercept” or “telecom intercept” technologies, or in the FBI’s “clandestine technical operations” unit, or its “covert access section,” or in video, audio, or electronic surveillance roles.
A further 11 FBI staffers are listed as working in HUMINT, or human intelligence, jobs, including several listed as working in the “Humint program management section.”
Trevor Hilligoss, a former Army investigator who worked with the FBI, said the information tying specific named people to human intelligence work was particularly troubling.
“You don’t have to look far to find examples of undercover agents being harmed when their cover is blown,” he said.
Hilligoss, now the chief intelligence officer for cybersecurity company SpyCloud, said his concerns were heightened by the inclusion of emergency contacts – often spouses or children – “who may have less operational security knowledge than their relative that works in a sensitive field.”
Reuters could not verify that all the job assignments were authentic or up-to-date, but it was able to match the career details or titles of eight people whose data was leaked to information in court filings, news articles, or public profiles on LinkedIn or to online posts on sites such as Instagram.
