Hackers Stole FBI Agents' Private Info From a Jobs Website

The FBI says hackers stole private information about its agents from the website people use to apply for FBI jobs. The bureau called it a "cyber security incident" in a message to staff, according to reporting on September 28. TechCrunch

The message said the stolen information included names, home addresses, job titles and Social Security numbers. Those numbers are ID numbers used in the U.S. for jobs and taxes.

Medical information was also taken. That included records about blood and urine tests and mental health reports.

Investigators say the hackers got in through a security hole in Oracle software that stores employee information. That software ran FBIJobs.gov, the site for job applications. Think of it like a filing cabinet connected to the internet. Because so much private information was kept together, attackers could copy it in bulk.

The group claiming the attack is called ShinyHunters, described by Reuters as a digital extortion group. The group claimed to hold data on mostly all of the FBI and a large amount of information on people who applied through FBIJobs.gov. TechCrunch

That confirmation follows a confusing week. Last week the FBI said it knew a hacking group had claimed an attack, but theft of data was "still undetermined". Reuters reported on September 22 that ShinyHunters said it had broken into the FBI and stolen data. The New York Times reported on September 23 that the hackers said they stole thousands of sensitive FBI records. The New York Times

The hackers claim to have every FBI agent's name, role and badge number, as well as agents' phone numbers. BBC The claimed material also includes detail about the job assignments and intelligence roles of scores of bureau officials. Reuters ShinyHunters said it stole sensitive personnel information belonging to thousands of people.

ShinyHunters said they do not want money. They want correction of an earlier report issued by the FBI. TechCrunch reported on September 22 that theft of this information could present a major counterintelligence threat involving threats against agents and their families.

The broader context here is about design, not a complex new hacking trick. Job applications, employee ID numbers and health records were kept in one system that could be reached from the internet. The fix is to keep these records apart, watch closely for information leaving the network, and fix security holes in public software quickly. Access to one set of records should not open the others.

In my view, this attack will push government hiring systems to separate these records. Job sites have long saved detailed records to keep hiring fast. Keeping health test results for a shorter time, hiding real Social Security numbers behind safer stand-ins, and storing job role information separately would lower the harm without stopping hiring. I watched my own children fill out detailed job forms online as young adults without knowing where those records go. When systems show clearly what is saved and who can see it, they tend to get fixed faster, and this breach gives a clear reason to build them that way.