FBI notifies employees of leak of their personal data — TechCrunch

According to TechCrunch, the U.S. Federal Bureau of Investigation notified agents and support staff that their personal data had been stolen during a cyberattack on the FBIJobs.gov employment portal. In an internal notice, the agency classified the situation as a cybersecurity incident.

Employees were informed of the leak of names, addresses, job titles, and Social Security numbers. This is the FBI's first acknowledgment that agents' personal information was stolen as a result of the incident. At the same time, the bureau has still not publicly confirmed the breach: last week, it said it was aware of the hacking group's claims about the attack, but that the theft of data was still being established.

Medical information

Several media outlets also confirmed that the stolen data includes medical information, including records related to blood and urine samples, as well as psychiatric reports.

An FBI spokesperson did not respond to TechCrunch's request for comment. A White House spokesperson also did not answer questions about whether the bureau had declared the case a significant incident.

More current news is available on the UA.News Telegram channel Telegram.

ShinyHunters' claims and portal operation

The ShinyHunters group told TechCrunch that it has data on most FBI employees, as well as a substantial amount of information about people who applied through FBIJobs.gov. According to the hackers, they accessed the data by exploiting a vulnerability in an Oracle PeopleSoft server that contained a large amount of personnel information about agents and current employees who had applied through the portal.

ShinyHunters claims it is not demanding a financial ransom, but instead seeks a correction to a previous FBI report that, in the group's view, incorrectly describes its activities. National security expert Justin Sherman described the leak as a counterintelligence catastrophe for the U.S. government and warned of risks of profiling, phishing, and contact with foreign intelligence services.

It is currently unclear whether the FBI has notified the U.S. Congress about the incident. Federal law requires lawmakers to be informed if a breach meets the criteria for a significant incident, including when the theft of personal data could cause tangible harm to U.S. national security. The FBIJobs.gov portal remained unavailable at the time of publication.