‘This kind of data has real utility in the wrong hands’: Cyber experts warn alleged FBI data breach could have serious real world consequences

The FBI has confirmed it is “actively and aggressively” investigating a breach which allegedly exposed employee and operational data.

“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the http://FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the agency said in a post on X.

The statement comes after the ShinyHunters ransomware group claimed to have compromised critical systems through a third-party vulnerability.

This, the group said, enabled access to several systems, including jobs portals and background check software, as well as a system used to store information relating to investigations.

According to ShinyHunters, the third-party software inquisition is Oracle PeopleSoft, an enterprise resource planning (ERP) suite used in human resources (HR), finance, and supply chain management.

Earlier this year, ShinyHunters claimed responsibility for a string of attacks after leveraging a zero-day vulnerability in the ERP software. Car manufacturer Nissan and the University of Nottingham were two of a string of organizations impacted.

In its statement on X, the FBI said the “point of breach is still undetermined”, adding that it is working closely with third-party providers related to impacted systems.

FBI breach could have huge consequences

The exact scope of data compromised in the breach remains unconfirmed, however, the group claims to have stolen data on thousands of employees. This includes agent names, badge numbers, and information such as home addresses and contact details.

Reports from Reuters suggest this also includes highly sensitive data on investigations into foreign intelligence operations as well as drug cartel activity.

If confirmed, exposure of this data could have serious real-world consequences, according to Joe Hancock, partner and head of cyber risk and complex investigations at law firm Mishcon de Reya.

“If the reports are accurate, this is a serious breach. This kind of data has real utility in the wrong hands, as we saw with the PSNI breach exposing people in sensitive roles translated into real-world risk,” he said.

“The fact the data appears to have come from an online jobs portal may limit some of the operational impact, but it doesn’t make the exposure of individuals’ identities any less serious,” Hancock added.

“Linking personal information to specific intelligence, counterespionage, or surveillance roles takes this well beyond conventional identity theft.”

Andrew Brandt, principal threat intelligence incident commander at Huntress, echoed Hancock’s comments. According to Brandt, a serious concern centers around whether the group might sell data to other criminal or nation-state groups that “could put it to more damaging use”.

“The FBI handles some of the most serious interstate and transnational crime investigations. It doesn't take much imagination to picture scenarios where employees or their families could be threatened or harmed by this kind of information being released,” he said.

ShinyHunters claims attack is not financially motivated

In a message on its dark web leak site, ShinyHunters claimed the attack was not financially motivated, but instead comes in response to an advisory by the agency which misrepresented the group’s activities.

The advisory, published by the FBI in May in the wake of attacks on the Canvas academic management system, said threat groups such as ShinyHunters often use “real or exaggerated claims” to pressure organizations into paying ransoms.

The ransomware gang has called on the agency to retract the advisory or it will publish the compromised data.

ShinyHunters has grown to become one of the most aggressive and active threat groups in the ransomware space, having claimed responsibility for attacks on Salesforce, Canvas, and the European Commission in recent months.

As ITPro reported this week, the group also claims to have hacked a rival ransomware group, Clop. This incident appears to have stemmed from a disagreement between the two ransomware gangs.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.