ShinyHunters Claims FBI Hack Exposed Sensitive Medical Records of Thousands of Agents

Cybercriminals who claim to have hacked the FBI say they obtained highly sensitive medical and fitness records belonging to thousands of special agents.

BBC News has reviewed samples of the allegedly stolen medical data, including blood and urine test results and a doctor’s note referring to symptoms such as “shellfish and banana allergies.”

What the Allegedly Stolen FBI Records Contain

The records include agents’ names and addresses, as well as medical details such as “blood in the urine” and “high cholesterol.” The samples shared with journalists also appear to contain phone numbers, badge numbers, job titles and information about spouses.

The data appears to involve thousands of agents, including senior officials such as deputy commissioners. Experts warn that the information could expose agents to fraud, blackmail and targeted attacks, while also helping criminals impersonate law enforcement officers.

“This list maps thousands of agents against their medical and fitness records,” said Etay Maor, vice president of threat intelligence at Cato Networks.

“Passwords can be reset if stolen, but medical records cannot be reset. So once this data is compromised, it remains compromised forever. That persistence across the workforce is what makes this breach so serious.”

FBI Investigating the Alleged Data Breach

The FBI did not respond to requests for comment. However, on Wednesday, the company acknowledged the breach and said it was “actively investigating” how it happened.

Cybercrime group ShinyHunters claimed on Monday that it had breached FBI systems and later posted details of the alleged attack on a darknet site.

The group also provided reporters with samples of the allegedly stolen data, along with extortion demands.

Hackers Demand FBI Recommendation Be Rescinded

Unusually, the hackers are not asking for money. Instead, they are calling for an FBI recommendation released in May to be rescinded, describing it as “offensive.”

The samples shared with journalists appear to be authentic. However, the FBI has not publicly confirmed the full scope or authenticity of the alleged data theft.

Professor Ciaran Martin, the former director of the UK’s National Cyber Security Centre, said the hack, if confirmed, would be “by far the most serious data breach.”