FBI probes ShinyHunters claims of massive agent data theft

The FBI on Sept. 22 said it was investigating claims by the notorious hacking group ShinyHunters that the threat actor stole data on thousands of current and former FBI agents.

Axios reported Sept. 23 that ShinyHunters stole more than 2 terabytes of sensitive FBI data on "almost all FBI agents and individuals who filed an application with the FBI for a job. "

The story first broke on 404 Media, which reported that the hackers breached a zero-day on an Oracle PeopleSoft human resources server, then pivoted to breach an Amazon-hosted government cloud storing the agents and applicants’ data.

The demand from ShinyHunters was unusual in that instead of pushing for a ransom, they want the FBI to take down an FBI report from last May that ShinyHunters said contains false information about the threat group.

Denis Calderone, chief technology officer at Suzu Labs, said ShinyHunters has spent the last week picking fights: On Friday they took over Clop's leak site and put up a “seized by ShinyHunters” banner, and by Tuesday the same banner was on the FBI's jobs portal.

Calderone said both were framed as payback, one for threats from a rival gang and one for an FBI advisory that told victims not to pay them.

“The FBI hasn't confirmed anything yet, but if this holds up, it doesn't look like the ShinyHunters we've been seeing all year,” said Calderone. “Their model has always been breach, extort, then settle or leak, and that only works when the victim can pay. The FBI isn't going to pay, and it isn't going to pull an advisory because a criminal group demanded it. Not sure what’s going to happen in a week, but I seriously doubt the FBI will act on this threat.”

Calderone also pointed out that ShinyHunters said this isn't financially motivated, but said we should all take it with a grain of salt.

“I have a hard time believing terabytes of FBI personnel data just sit on a shelf,” said Calderone. “Foreign intelligence services would love to have it, and having the FBI on their resume makes every future extortion demand more believable, and if the PeopleSoft zero-day is real, the exploit may be worth more than the data. Meanwhile, agents and their spouses could have their home addresses posted publicly within a week if this threat is followed through.”

Collin Hogue-Spears, senior director of solution management at Black Duck, pointed out that the data sample posted by ShinyHunters does not establish where the records came from, when they were obtained, or whether they came from FBI systems. Hogue-Spears said ShinyHunters has produced no public evidence of access to the FBI’s internal HR system or FBINet, and the FBI, Oracle, and AWS have not confirmed the group’s claims.

The strategic lesson here extends beyond this incident, said Hogue-Spears: internet facing recruiting portals must operate as narrowly scoped intake systems. They need permission to submit applicant records, not retrieve employee data. Organizations must also block public access to PeopleSoft management interfaces such as /PSEMHUB/.

“A compromised FBI workload would not automatically constitute an AWS breach, but excessive permissions or exposed administrative functions can turn a public job portal into a path toward the HR system behind it,” explained Hogue-Spears.