FBI agents walk as protesters block U.S. Immigration and Customs Enforcement (ICE) personnel from entering a building in Chicago, Illinois, U.S., June 16, 2025. REUTERS/Dylan Martinez
The FBI's hacked personal data didn't merely reveal contact information for 60,000-plus agents and officials; it also contained private details about blood and urine tests, the BBC reported on Friday.
The black-hat hacker group ShinyHunters stole the "fitness-for-work" medical examinations, including the files of an agent, a potential agent and even senior officials or deputy directors. That information includes doctors' notes and even medical conditions like a "shellfish and banana allergy" or even "high cholesterol." There is also information about an agent's spouse. The group has shared some of the samples of data they obtained with the extortion demands.
It could mean that agents remain vulnerable to scams, blackmail and targeted attacks, the report claimed. It could also mean that law enforcement officers could be more easily impersonated.
"The list maps thousands of agents against their medical and fitness records," Etay Maor, VP of threat intelligence at Cato Networks, told the BBC.
"Passwords can be reset if stolen, but medical records cannot, so once this data is out, it stays compromised for good. That permanence, applied across an entire workforce, is what makes this leak so serious," he said.
"Such data could be used for highly convincing phishing, impersonation, identity fraud, blackmail or even operations targeting law-enforcement personnel, making the potential implications particularly serious," said CyberSmart co-founder Jamie Akhtar.
The FBI has acknowledged only the breach so far. They haven't detailed how it happened yet, but they're "aggressively investigating it."
The BBC noted, "Unusually, the hackers are not demanding money. Instead, they are seeking a retraction of an FBI advisory published in May, which they claim 'offended' them."
Reuters reported that some of the hacked data included information on agents involved in investigations around Russia, China and drug cartels.
404 Media reported that the data may also have revealed a little-known FBI hacking unit with a secretive team.
The hackers told reporters they would publish the information in five days if their demands weren't met.
The records appear to relate to thousands of agents, including senior officials such as deputy directors.
Professor Ciaran Martin, the former head of the UK's National Cyber Security Centre, has described the hack — if confirmed — "as serious as it gets when it comes to data breaches."
According to the hackers, they found a vulnerability in an Oracle PeopleSoft cloud storage system being used by the FBI. Oracle is the company co-founded and currently led by top supporter of President Donald Trump, Larry Ellison.
They were able to gain access to multiple platforms, including FBIJobs, FBI BEAST, which handles background checks on employees and applicants, FBI MedLink, which stores medical records, and FBI BICS, which contains investigative information," the BBC said.