Current and former FBI agents have spoken to BBC News of their shock, fear and anger following a hack that appears to have exposed the private and personal information of the agency’s entire workforce.
“This is really bad for our undercover agents,” says one former FBI agent, who fears for the safety of his colleagues.
The former cyber investigator is in a group chat with current agents who are worried their personal information could soon be freely available online to criminals and hostile nation-state hackers.
He says staff fear they could be targeted, or that criminals could use the data to create highly convincing phishing attempts, scams or demands for bribes.
The hacking group ShinyHunters is threatening to publish the stolen databases and documents within four days unless its demands are met.
Some agents are also concerned about the risk of physical attacks from cyber criminals they have investigated.
“One of the things we are discussing in the group chat is ‘violence-as-a-service’ attacks from young online gangs,” says the former worker.
“They could use this information to harass an FBI agent who has worked on their cases.”
Personal concerns
Groups similar to ShinyHunters – believed to be an English-speaking gang – have in the past been linked to swatting incidents, and even petrol bomb attacks against law enforcement officers and rivals.
The group claims it breached FBI systems on Monday and later posted details of the attack on its darknet site.
The FBI has not responded to requests for comment.
However, on Wednesday the agency acknowledged the breach – saying it was “aggressively investigating” how it occurred.
For Michael McPherson, a former FBI agent who is now senior vice president of security operations at cyber firm ReliaQuest, the hack presents “a security threat which cuts to the core of agent safety, particularly their families”.
He says agents understand the “inherent risks” that come with the job.
“But this incident reportedly includes personal data such as home addresses and contact information, which could expose family members who are normally insulated from the threats associated with such a career,” McPherson says.
ShinyHunters shared samples of the alleged stolen data with reporters, along with an extortion demand.
The samples appear genuine and include names, addresses, phone numbers, badge numbers, job titles and information about spouses.
The records appear to relate to thousands of agents, including senior officials such as deputy directors.
The criminals also appear to possess highly sensitive medical information relating to thousands of special agents.
BBC News has seen samples of stolen “fitness-for-work” medical examinations containing information such as blood and urine test results, along with doctors’ notes mentioning conditions including a “shellfish and banana allergy”.
Agents’ full names and addresses, as well as references to medical issues including “blood in the urine” and “high cholesterol” are now in the criminals’ hands.
Cynthia Kaiser, who was the Deputy Director of Cyber at the FBI and now leads the Research Centre at Halcyon says ShinyHunters appear to already have lost control of some of the data which is circulating in various online groups of cyber researchers and could lead to harm even before the main tranche is published.
“A lot of the damage may already be done, and as we have seen in past FBI data breaches, that information continues to circulate the dark web years later,” she said.
There are also concerns about the breach’s national security implications, such as staff becoming targets for recruitment efforts by hostile foreign intelligence services.
Fallout fears
Alongside fear, many of those who spoke to the BBC expressed anger at the FBI for allowing the data to be stolen.
The hack is particularly embarrassing from a technical perspective because ShinyHunters is not generally regarded as a highly sophisticated hacking group.
One former cyber agent said FBI staff were furious about the “sloppy and lazy security failures” that allegedly enabled the breach.
There is also confusion about how to handle any fallout if data is published next week, as threatened.
The FBI appears unlikely to comply with the extortion demands, and the hackers have indicated they intend to post the information on their darknet site.
Unusually, the group is not demanding money. Instead, it wants the FBI to retract an advisory published in May, which it claims “offended” them.
