ShinyHunters Say FBI Data Held Back for Now as Expert Calls Hack 'Retaliation'

The hacking group ShinyHunters said Wednesday it is trying to keep the FBI personnel records it claims to have stolen from spreading widely while it waits for the bureau to withdraw a public advisory about the gang, Al Jazeera reported. The FBI says it has not yet determined whether the intrusion hit its own network or a third-party provider.

A cybersecurity expert told the BBC it was a "retaliation attack," which demonstrated that "no organisation is safe from the group." The group says it holds data on about 38,000 people, including everyone who has applied to join the bureau.

Why it matters

The hackers are holding the files over the FBI's description of them rather than for money. Reuters reported that some of the files describe officials' assignments, including work against Chinese spies, Russian intelligence and drug cartels.

Key points

• ShinyHunters says it is holding stolen FBI personnel data until the bureau rescinds a May statement about the group and is trying to keep the files from circulating in the meantime.
• The group claims records on about 38,000 staff and applicants, including badge numbers, home addresses, phone numbers and spouse details.
• The FBI says the point of the breach is still undetermined, and the jobs portal remained offline Wednesday afternoon.

ShinyHunters' demand and the 'retaliation attack'

The group said Tuesday that it had taken data on a large number of current and former employees and would hold it until the bureau rescinds an unflattering May statement, Al Jazeera reported.

The BBC reported that the group has given the FBI one week to act or it will publish the full databases, and that it said it was "offended."

The FBI investigation into the FBIJobs breach

In a statement Wednesday, the FBI said it was working with the third-party providers that support the site.

The hackers say they got in Monday night through a flaw in an Oracle cloud storage system and reached the jobs site and systems holding background checks, medical records and investigation information, the BBC reported. The BBC said the data it saw appeared genuine.

ShinyHunters, believed to have started in France, has been linked to breaches of Rockstar Games in April and the education platform Canvas in May, the BBC reported.

Update: This article was updated with ShinyHunters' statement that it is trying to keep the data from circulating and an expert's description of the breach as a "retaliation attack."