FBI tells staff: assume the hackers already have your address 🕵️

The FBI has told its own employees to assume hackers stole their personal information, according to an internal memo reported this week by Reuters. The bureau is operating from the premise that data on every staffer may be out, following a claimed breach of its jobs site, FBIjobs.gov. The group claiming credit, ShinyHunters, says it holds data on nearly all FBI agents and on everyone who applied for an FBI job, putting the haul at 2 to 3 terabytes that include names, phone numbers, home addresses and, in some cases, spouse details. If the claim is accurate, the scope reaches past agents to anyone who applied for an FBI job.

ShinyHunters says the intrusion began Monday night and that by Tuesday, Sept. 22, visitors saw a banner stating the site had been seized. The group says it gained access through a previously unknown flaw in Oracle's PeopleSoft, human-resources software used by many organizations — the type of bug security researchers call a zero-day, for which no patch yet exists. The FBI has not confirmed the method. The group also says the trigger was an FBI advisory: a May 15 notice warning that ShinyHunters uses harassment, including threats to victims' family members and, in some cases, swatting — fake emergency calls that send armed police to a target's door. ShinyHunters denies the description and gave the bureau one week to retract the warning.

ShinyHunters surfaced in 2020 selling stolen databases on hacker forums and helped run BreachForums, one of the largest such marketplaces. Last year the group claimed to have obtained about 1.5 billion records from customers of Salesforce, a widely used customer-data platform. The FBI has publicly pushed back. Cyber Division Chief Brett Leatherman posted a video on X on Sept. 29 pointing to a Dutch arrest from Sept. 15 and telling the hackers, "we know how to find you," urging them to reach out first; the group says the arrested man has no association with it. ShinyHunters later said the ultimatum was a marketing campaign and that it does not plan to publish the data.

The internal memo instructs staff to expect virtual briefings and to monitor for suspicious texts or calls from unknown numbers. The warning carries weight because stolen data rarely stays on a screen — if it is released and employees are doxxed, identity theft cases could surge and relatives of FBI personnel could face heightened risk. The crypto sector has already shown similar patterns: Coinbase said bribed support agents leaked customer data last year and then faced a $20 million extortion demand, and as of April, France had recorded 135 crypto-related "wrench attacks" since 2023, with 88 suspects charged.