FBI hack exposes sensitive roles of intelligence officers, report

Personal information allegedly stolen from the FBI includes details of officials working on sensitive investigations involving China, Russia and surveillance, according to an analysis of the data by Reuters.

The FBI said it was investigating claims by the cybercrime group ShinyHunters that it had compromised the bureau's recruitment website, FBIJobs.gov.

The bureau said the point of the alleged breach remained unclear and that it was actively investigating the incident.

Reuters said it had independently verified details belonging to more than 22 people in a 5,000-line spreadsheet, although it could not authenticate the entire document.

The spreadsheet reportedly contains names, addresses, dates of birth, telephone numbers, Social Security numbers and emergency information.

It also identifies employees' assignments to particular FBI field offices and, in some cases, units involved in intelligence, counterespionage and surveillance operations.

Among the records are 14 people described as working on China-related matters, including units labelled the "China criminal enterprise unit", "China tech transfer analysis unit" and "China intelligence section".

Nine employees are listed in Russia-related roles, including two assigned to a "Russia Operations Section" and another working on what is described as Russia-related critical infrastructure and technology threats.

The data also includes three people linked to Iran- or Hezbollah-focused intelligence work.

A further 18 employees are identified as working with data or telecommunications interception, clandestine technical operations, covert access, or video, audio and electronic surveillance.

Eleven others are listed in human intelligence, or HUMINT, positions.

Hackers claim much larger haul

ShinyHunters claims the spreadsheet is only a small sample of between 2TB and 3TB of data stolen from current and former FBI employees and job applicants.

The group says it exploited a previously unknown bug in Oracle PeopleSoft, software widely used for human resources and recruitment.

It claims the vulnerability allowed remote code execution on systems supporting the FBI's recruitment platform, followed by movement into other environments hosted on AWS GovCloud.

The FBI has not confirmed those claims.

ShinyHunters said it was withholding the stolen information until the bureau withdraws a statement the group issued in May.

At that time, the FBI warned that ShinyHunters used harassment tactics, including threats against victims and their families, and could exaggerate claims stolen data as part of extortion attempts.

ShinyHunters has rejected those allegations.

Former agent warns of intelligence risk

Eric O'Neill, a former FBI counterintelligence operative, described the alleged information as potentially valuable to foreign intelligence services.

He said identifying FBI personnel working against particular countries could reveal who is involved in sensitive investigations.

O'Neill also warned that the information could be of interest to hostile intelligence services and extremists.

Reuters said the data had not been fully authenticated, but it was able to verify more than 22 individual records by comparing information in the spreadsheet with credit records and previously leaked data.

ShinyHunters said it was attempting to prevent the personnel information from being widely circulated.

The FBI has not confirmed the extent of any compromise.

This week, ShinyHunters also claimed to have breached rival ransomware group Clop , defaced its leak site and stolen sensitive server data.

It said the attack followed alleged threats from a Clop representative during a dispute dating to Clop's 2025 campaign against Oracle E-Business Suite.

ShinyHunters also alleged that Clop had obtained its exploit without permission and that a Clop representative had threatened to kill members of the group.