What did ShinyHunters claim to have stolen in its reported breach of FBIjobs.gov and other FBI systems, what psychiatric, medical, and personnel information did Reuters review and partially authenticate, what remains unverified about the alleged 2–3 terabytes of data and the hack

ShinyHunters claimed it stole sensitive records on current and former FBI employees and job applicants after accessing FBIjobs.gov and other FBI systems. Reuters reviewed samples of psychiatric, medical and personnel material, but those samples do not establish the full size of the alleged theft or the extent of the hackers’ access. 451

What is known—and what is not

• Claimed theft: The group said it held data on nearly all FBI agents and job applicants, and claimed to have taken 2–3 terabytes of FBI and Justice Department-related data. Those figures remain the hackers’ claims, not a verified inventory. 41011
• Material reviewed: Reuters reviewed sensitive psychiatric and medical evaluation records and partially authenticated some files. Separately, a roughly 5,000-line spreadsheet it examined described employees’ assignments, including work concerning Chinese spies, Russian intelligence and drug cartels. The BBC also examined sample fitness-for-work records containing blood and urine test results and doctors’ notes. 516
• Limits of verification: The reviewed samples do not verify that the hackers possess 2–3 terabytes, records for nearly everyone claimed, or access to other FBI systems beyond the reported jobs-portal activity. ShinyHunters said it used an Oracle PeopleSoft vulnerability; Reuters had not verified that account of how the FBI data was accessed. 513
• Responses: The FBI said it was investigating claims of unauthorized activity affecting FBIjobs.gov and later described its investigation as aggressive; it did not confirm the hackers’ full account. ShinyHunters publicly asserted that it had compromised the FBI and held sensitive employee and applicant data. 4511

The counterintelligence risk is that detailed assignments could identify people working on sensitive investigations, while personal and health information could help an adversary target, pressure or impersonate them. That is a potential consequence of the material described—not proof that an adversary has used it. 15