ShinyHunters Steal 60,000 FBI Staff Medical Records, Demand Retraction of May Advisory
Updated
Updated · bbc.co.uk · Sep 25
ShinyHunters Steal 60,000 FBI Staff Medical Records, Demand Retraction of May Advisory
3 articles · Updated · bbc.co.uk · Sep 25
Summary
Samples reviewed by BBC show ShinyHunters obtained FBI “fitness-for-work” exams with blood and urine results, doctors’ notes, home addresses and badge details for thousands of special agents, including senior officials.
The group now claims the breach reaches about 60,000 current and former FBI staff and says it will publish the full dataset within five days unless the FBI retracts a May anti-ransom advisory.
ShinyHunters says it exploited an Oracle cloud storage flaw affecting systems including FBIJobs, MedLink, BEAST and BICS, while the FBI says it is still determining whether its own systems or a third-party provider were compromised.
Experts say the leak is unusually dangerous because medical records cannot be reset, leaving agents exposed to phishing, impersonation, blackmail and targeted attacks, including those tied to Russia, China and cartel investigations.
How did a notorious hacking group manage to breach the FBI's highly secure recruitment portals?
Will the FBI bow to hacker demands and retract its cyber warning to prevent a massive data leak?
ShinyHunters’ 2026 FBI Breach: 3TB Data Theft, Agent Exposure, and the Collapse of Federal Digital Trust
Overview
On September 22, 2026, ShinyHunters exploited a critical flaw in Oracle PeopleSoft on FBIjobs.gov, using scanning tools to find the vulnerability and a crafted SSRF attack to gain command-line access. They found stored credentials and, due to poor network segmentation, moved into the FBI’s backend HR database on AWS GovCloud, exfiltrating terabytes of sensitive data. The breach exposed personal information of FBI personnel and their families, making them targets for retaliation and harassment. This incident, triggered by a prior FBI advisory, highlights how weaknesses in third-party software and network design can lead to severe operational and personal risks for government agencies.