FBI reportedly declares 'cyber security incident' after breach

The FBI has reportedly told its agents and support staff that their personal information was stolen in a recent cyberattack that targeted the bureau’s job application portal — the bureau’s first acknowledgment that FBI agents’ personal information was taken in the breach. The FBI has not publicly confirmed a breach beyond a statement last week saying it was aware a hacking group had claimed a cyberattack, but that the theft of data was “still undetermined.” As reported by MS NOW’s Ken Dilanian over the weekend, the FBI has since declared a “cyber security incident” in an internal notification, telling staff that their names, addresses, job titles and Social Security numbers were exposed. Several outlets have since confirmed the stolen data also included medical information, including records related to blood and urine samples and psychiatric reports.

The hacking group ShinyHunters previously told TechCrunch it has “data on mostly all of FBI,” including a “substantial” amount of information on applicants who applied through the FBIJobs.gov portal. The hackers said they broke in by exploiting a vulnerability in an Oracle PeopleSoft server that hosts human-resources information on agents and applicants. They told TechCrunch they are not seeking a financial ransom, but are instead demanding the correction of an earlier FBI-issued report they say misrepresents their activities.

National security expert Justin Sherman called the breach a “counterintelligence disaster” for the U.S. government in a blog post for Lawfare, warning that the theft “would expose thousands of FBI personnel to profiling, phishing, foreign intelligence approaches, and much more.”

It remains unclear whether the FBI has disclosed the incident to the lawmakers who have oversight of the bureau. Under federal law, notifying Congress is required when an intrusion meets the bar of a “major incident” — such as a breach involving personally identifiable information that is “likely to result in demonstrable harm” to U.S. national security — and bureau lawyers are likely still determining whether that threshold has been met. If disclosure is required, it would be the FBI’s second known notification to lawmakers about a data breach this year, after suspected Chinese hackers broke into a surveillance system earlier this year that exposed the targets of FBI surveillance and investigations. Spokespeople for the FBI and the White House did not respond to requests for comment Monday, and the job portal — the bureau’s primary application channel since 2017 — remains down.

Why it matters

A breach that exposes FBI personnel records, including Social Security numbers and medical data, is a foreign-intelligence and phishing risk that follows agents individually, not just an IT problem for the bureau to patch.