FBI reportedly declares ‘cyber security incident’ after hackers steal agents’ personal data

Your personally identifiable information, including Social Security numbers and medical records, is now exposed if you applied for an FBI job.

The Federal Bureau of Investigation (FBI) has declared a "cyber security incident" following a breach of its job application portal, FBIJobs.gov. Hackers, identified as ShinyHunters, exploited a vulnerability in an Oracle PeopleSoft server to steal sensitive personal data of FBI agents and applicants. This data includes names, addresses, job titles, Social Security numbers, and even medical information such as records of blood and urine samples and psychiatric reports. The hackers claim to possess data on "mostly all of FBI" and a "substantial" amount of applicant information. They are reportedly not seeking financial ransom but are demanding the FBI correct an earlier report they believe misrepresented their activities. The FBIJobs.gov portal remains offline.

This breach highlights a significant vulnerability in government human resources systems, particularly those reliant on older Oracle PeopleSoft infrastructure. The compromise of sensitive personal and medical data for federal agents and applicants presents a serious counterintelligence risk, potentially exposing thousands to foreign intelligence gathering, profiling, and sophisticated phishing attacks. The FBI's internal declaration and the ongoing uncertainty about notification to Congress underscore the gravity and potential legal ramifications of the incident.

The hackers' stated motive, demanding a correction of an FBI report rather than financial gain, suggests a potentially ideologically driven or reputational attack rather than a typical cybercriminal operation. This incident may prompt a broader review of security protocols for federal employment portals and the vetting of third-party software vendors like Oracle, potentially leading to increased scrutiny and stricter compliance requirements for government contractors handling sensitive data.