Anadolu via Getty ImagesCurrent and former FBI agents have spoken to BBC News of their shock, fear and anger following a hack that appears to have exposed the private and personal information of the agency’s entire workforce.
“This is really bad for our undercover agents,” says one former FBI agent, who fears for the safety of his colleagues.
The former cyber investigator is in a group chat with current agents who are worried their personal information could soon be freely available online to criminals and hostile nation-state hackers.
He says staff fear they could be targeted, or that criminals could use the data to create highly convincing phishing attempts, scams or demands for bribes.
Some agents are also concerned about the risk of physical attacks from cyber criminals they have investigated.
“One of the things we are discussing in the group chat is ‘violence-as-a-service’ attacks from young online gangs,” says the former worker.
“They could use this information to harass an FBI agent who has worked on their cases.”
Personal concerns
Groups similar to ShinyHunters – believed to be an English-speaking gang – have in the past been linked to swatting incidents, and even petrol bomb attacks against law enforcement officers and rivals.
Swatting is a phenomenon so-called because perpetrators make calls that prompt armed police units – called Swat teams in the US – to swoop in on victims.
The group claims it breached FBI systems on Monday and later posted details of the attack on its darknet site.
The FBI has not responded to requests for comment.
However, on Wednesday the agency acknowledged the breach – saying it was “aggressively investigating” how it occurred.
For Michael McPherson, a former FBI agent who is now senior vice president of security operations at cyber firm ReliaQuest, the hack presents “a security threat which cuts to the core of agent safety, particularly their families”.
He says agents understand the “inherent risks” that come with the job.
“But this incident reportedly includes personal data such as home addresses and contact information, which could expose family members who are normally insulated from the threats associated with such a career,” McPherson says.
ShinyHunters shared samples of the alleged stolen data with reporters, along with an extortion demand.
The samples appear genuine and include names, addresses, phone numbers, badge numbers, job titles and information about spouses.
The records appear to relate to thousands of agents, including senior officials such as deputy directors.
The criminals also appear to possess highly sensitive medical information relating to thousands of special agents.
BBC News has seen samples of stolen “fitness-for-work” medical examinations containing information such as blood and urine test results, along with doctors’ notes mentioning conditions including a “shellfish and banana allergy”.
Agents’ full names and addresses, as well as references to medical issues including “blood in the urine” and “high cholesterol” are now in the criminals’ hands.
Cynthia Kaiser, who was the Deputy Director of Cyber at the FBI and now leads the Research Centre at Halcyon says ShinyHunters appear to already have lost control of some of the data which is circulating in various online groups of cyber researchers and could lead to harm even before the main tranche is published.
“A lot of the damage may already be done, and as we have seen in past FBI data breaches, that information continues to circulate the dark web years later,” she said.
There are also concerns about the breach’s national security implications, such as staff becoming targets for recruitment efforts by hostile foreign intelligence services.
Fallout fears
Alongside fear, many of those who spoke to the BBC expressed anger at the FBI for allowing the data to be stolen.
The hack is particularly embarrassing from a technical perspective because ShinyHunters is not generally regarded as a highly sophisticated hacking group.
One former cyber agent said FBI staff were furious about the “sloppy and lazy security failures” that allegedly enabled the breach.
There is also confusion about how to handle any fallout if data is published next week, as threatened.
The FBI appears unlikely to comply with the extortion demands, and the hackers have indicated they intend to post the information on their darknet site.
Unusually, the group is not demanding money. Instead, it wants the FBI to retract an advisory published in May, which it claims “offended” them.
“The agency leadership is lost,” the former cyber investigator tells me.
He says staff have been advised to sign up to a service called DeleteMe, which helps remove personal information from data broker websites – a response he feels is inadequate.
ReutersAccording to another former agent, there is widespread shock that such a breach could happen at one of the world’s best-resourced law enforcement agencies.
“You would think this information would not be internet-exposed. It’s disturbing, actually,” he says.
‘Kicked a sleeping lion’
There is also embarrassment that a prolific group of young cyber criminals has repeatedly managed to evade law enforcement while carrying out a string of high-profile hacks.
ShinyHunters has been linked to numerous extortion attacks, including on Rockstar Games and the education platform Canvas.
The group regularly communicates with reporters via Telegram, where members often boast about their activities.
“The bureau doesn’t know what to do with teenage cyber criminals,” one former agent says.
McPherson says there is no doubt the FBI is taking the incident extremely seriously.
He expects the agency to draw on its extensive network of partners and resources “to make this group suffer the consequences for this brazen and taunting attack”.
Kaiser added that the hackers have been “reckless and foolish” and warned them to expect “a significant effort by the FBI to quickly bring them to justice.”
Sign up for our Tech Decoded newsletter to follow the world’s top tech stories and trends. Outside the UK? Sign up here.
