FBI Reportedly Declares Cyber Security Incident After Hackers Steal Agents' Personal Data
FBI employees were told their personal data was stolen in a breach of the bureau's job portal, reports say.
As reported by MS NOW reporter Ken Dilanian over the weekend, the FBI has since declared a "cyber security incident" to staff and told employees that their names, addresses, job titles and Social Security numbers were exposed. Several media outlets have since confirmed that some of the stolen data included medical information, such as records relating to blood and urine samples, as well as psychiatric reports.
The hacking group ShinyHunters previously told TechCrunch that it had "data on mostly all of FBI" and a "substantial" amount of information on applicants who applied through the FBIJobs.gov portal. The hackers said they broke in by exploiting a vulnerability in an Oracle PeopleSoft server, which hosts human resources information on agents and current employees who applied through the portal. They told TechCrunch they are not seeking a financial ransom but are demanding the correction of an earlier FBI-issued report that they say misrepresents their activities.
Justin Sherman, a national security expert, called the data breach a "counterintelligence disaster" for the U.S. government in a blog post for Lawfare. He warned that the data theft would "expose thousands of FBI personnel to profiling, phishing, foreign intelligence approaches, and much more."
It is less clear whether the FBI has disclosed the incident to lawmakers in Congress who oversee the bureau. Under federal law, alerting Congress is required when an intrusion meets the bar of a "major incident," such as if a data breach involves the theft of personally identifiable information that is "likely to result in demonstrable harm" to U.S. national security. The bureau's lawyers are likely trying to determine whether that threshold has been met. If a disclosure is required, it would be the FBI's second known notification to lawmakers this year about a data breach, after hackers suspected to be Chinese broke into a surveillance system that exposed targets of FBI surveillance and investigations earlier this year.
An FBI spokesperson did not respond to TechCrunch's request for comment on Monday, and a White House spokesperson also did not respond to an email asking whether the bureau had declared a major incident. Representatives for several lawmakers whose jurisdictions cover oversight of the FBI did not have any immediate answers. ABC News reports that the FBI's job site has been the primary way to apply for a job with the bureau since 2017, and the portal remained down at the time of publication.
Editor's Summary
The FBI has told employees their personal information, including Social Security numbers and medical records, was exposed in a breach of its job application portal, according to reports. The hacking group ShinyHunters said it exploited an Oracle PeopleSoft vulnerability and is demanding a correction to an FBI report rather than a ransom. It remains unclear whether the incident will trigger a required notification to Congress.