The FBI is currently investigating a significant cyberattack involving the alleged theft of sensitive medical and personal data belonging to thousands of its current and former employees. The hacking collective known as ShinyHunters claims to have breached the agency's systems, asserting that they now possess records for approximately 60,000 individuals.

The stolen data reportedly includes detailed "fitness-for-work" medical examinations, featuring blood and urine test results, doctors' notes, and information regarding specific health conditions. Beyond medical history, the exposed files contain personal identifiers such as full names, home addresses, phone numbers, badge numbers, and details concerning spouses. According to reports, the breach may also involve information related to investigations into foreign nations and drug cartels, as well as data from internal systems like FBI MedLink and FBI BEAST.

Unlike typical cyber-extortion cases, the hackers are not requesting a financial payment. Instead, they have issued a demand for the FBI to retract an advisory published in May that the group claims was offensive to them. The hackers have threatened to release the full dataset publicly if their conditions are not met within five days.

Advertisement

Cybersecurity experts have expressed alarm regarding the potential consequences of the leak. Etay Maor of Cato Networks noted that while passwords can be changed, the permanent nature of medical records makes this breach particularly damaging. Similarly, Jamie Akhtar of CyberSmart warned that the information could facilitate sophisticated phishing, identity fraud, and blackmail attempts against law enforcement personnel.

The FBI has acknowledged the incident and stated that it is working to determine if the breach occurred through a direct attack on its infrastructure or via a third-party provider. The agency is currently investigating the vulnerability, which the hackers claim was found in an Oracle cloud storage system.

Source: BBC News