Personal data that the ShinyHunters hacking group took from the FBI may cover tens of thousands of current and former employees, by the group's own count, and appears to reveal who works on counterintelligence and foreign-threat desks, The New York Times reported Monday. An internal bureau memo said the FBI was proceeding on the assumption that the hackers were extracting personal information on all of its employees, according to the Times.

What Happened

The hackers shared a sample of records with the Times and other news organizations. The Times said its review found names, home addresses, phone numbers, work emails, Social Security numbers, and birth and hire dates. The files also list spouses and other emergency contacts, in some cases parents, siblings and children, along with employee identification numbers used for the Transportation Security Administration's PreCheck program.

The sample also names the units where people work, their job titles and their supervisors. Many entries are routine, but others point to counterintelligence, narcotics and desks focused on Russian, Chinese and Iranian national security threats. Birth dates in the sample run from the early 1940s to the mid-2000s, and the latest dates in the spreadsheet are from late April. Current and former U.S. officials told the paper that at least part of the sample, and possibly all of it, looked authentic. ShinyHunters has also claimed it took medical data, including psychiatric records and documents related to blood and urine tests, and Reuters said it had partially authenticated some of those files.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

The memo that declared the cyber incident on Sept. 25 also told staff the bureau would hold virtual briefings. It advised them to stay alert at home and at work, report unsolicited contacts or threats, avoid calls from unknown numbers and record voicemail greetings with AI-generated voices. According to current and former officials, many employees first learned of the hack from news reports on Sept. 22. Some have since asked Times reporters whether their own names appear in the data. In a Monday statement, the FBI said it was investigating the incident involving FBIJobs.gov around the clock and keeping in regular contact with anyone who might be affected.

Why It Matters

Former bureau officials and security experts told the Times the data could help violent criminals find agents who put them in prison. Agents sign their names to case paperwork but are trained to keep personal details off the internet. Foreign spies could use the records to build dossiers and follow agents for years, cross-referencing them with other leaked data using AI tools, experts said.

Andrew Brandt, a threat intelligence researcher at Huntress, said a sale to criminal or nation-state groups worried him more than a public dump. Ciaran Martin, the former head of Britain's National Cyber Security Centre, said the hack likely had a "huge impact on the operational capability" of the bureau. He suggested it could prove worse than China's theft of more than 20 million records from the Office of Personnel Management a decade ago, because Beijing was never going to sell or publish that data.

A String of Lapses

The Times placed the breach in a run of security failures at the bureau. Two years ago, investigators found that the Chinese campaign known as Salt Typhoon had reached wiretap systems at Verizon and AT&T that handle court-authorized surveillance orders for the FBI. China has denied involvement. This spring, suspected Chinese hackers were again found inside an FBI network used for domestic surveillance orders. Bureau leaders had also warned staff that hackers linked to ShinyHunters who broke into AT&T in 2024 may have taken months of call and text logs belonging to some agents.

The group says it used a previously unknown flaw in Oracle PeopleSoft. A person familiar with the matter told the Times, though, that investigators believe a PeopleSoft bug disclosed and patched in June was involved. Google said last week that ShinyHunters had renewed mass exploitation of that bug, but it did not tie the flaw to the FBI breach. The FBI's Dallas field office is leading the investigation into the group with international partners, according to people familiar with the matter.

What to Watch

ShinyHunters had given the FBI until the end of Tuesday to correct or withdraw its spring advisory about the group's harassment of victims. On Monday, ahead of that deadline, the group said it had never intended to publish the data and would take no further action with it, though it later told CBC News it could not guarantee the sample already shared with journalists would stay private. On Tuesday, the FBI posted a video warning that it would aggressively pursue the group's members, pointing to the recent arrest in the Netherlands of a 24-year-old suspect it said was affiliated with ShinyHunters. The group denies he is a member. It also says the breach is far worse than publicly known but has not said how, and researchers note it sometimes exaggerates, though its claims about this breach have largely held up so far.