The FBI is investigating a claimed compromise of its FBIJobs.gov recruiting portal and a potential impact to employee personally identifiable information (PII), but it has not yet determined where the alleged breach occurred.
“The FBI is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the FBI said in a Sept. 23 press release.
“While the point of breach is still undetermined – whether a third-party or the FBI’s enterprise – we are actively and aggressively investigating this matter and working closely with those third-party providers that support fbijobs.gov to mitigate any and all risk,” the bureau said.
As of Wednesday afternoon, the FBI jobs site is still offline.
ShinyHunters claimed responsibility for the incident in a statement directed to FBI Director Kash Patel and Cyber Division Assistant Director Brett Leatherman. The group said it had “compromised the FBI” and obtained “very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job.”
ShinyHunters said it carried out the attack in response to what it characterized as false allegations in an FBI announcement issued in May. The group disputed FBI descriptions of its tactics, including allegations that it exaggerates access to sensitive information and uses harassment to pressure victims.
The group gave the FBI one week to correct or remove the disputed material and said its action was not financially motivated. The FBI did not address those demands in its statement or provide a timeline for completing its investigation.
“ShinyHunters isn’t expecting a ransom from the FBI. It’s defending its brand,” analysts from Flashpoint, a threat intelligence company, said in a statement to MeriTalk.
“By publicly taking on the agency, ShinyHunters is trying to rebuild its credibility and push future victims back toward the negotiating table,” they added. “Since the FBI will likely not engage with ShinyHunters, we expect the group to follow the same playbook it uses against corporate victims and leak the stolen data.”