Shiny Hunters claims breach of FBI employee data and demands retraction

A cybercrime group called Shiny Hunters says it has hacked the FBI and stolen personal data on 38,000 employees. The group contacted journalists on Monday night to make the claim. One journalist was sent a small sample of the data and said it looked legitimate. Other journalists downloaded a larger sample that the group is offering.

The group says the data includes first names, last names, badge numbers, home addresses, phone numbers and spouse information. That would make the breach especially sensitive because many FBI officers work in secretive roles and need to stay out of public view. The larger sample is said to contain more serious material, including information about ongoing operations against cartels and discussions about Chinese and Russian operations.

Shiny Hunters is described as a prolific cybercrime group. It is said to be young and English speaking, but its location is unknown. It may be in the UK or France. The group is publicising its demands on Telegram and a darknet website. Unusually, it is not asking for money. Instead, it wants the FBI to retract a statement it issued about Shiny Hunters in May. The group says it is offended by that statement. Much of the other material posted online was dismissed as nonsense, and the motive appears to be to embarrass the FBI.

The incident has raised wider questions about cyber defences. Security targets are under constant attack, and human error is often the way in. A single lapse, such as responding to a phishing email, can give attackers access. National defences are seen as patchy, and cybersecurity can slip down the list when budgets are tight. Even when systems are improved, the work does not stop. The discussion also considered whether the UK could face a similar attack on a police force, the National Crime Agency or the NHS.