FBI agents report fear after data breach exposes psychiatric files

The FBI said on Wednesday that it is investigating a claim by the cyber-extortion group ShinyHunters that it breached the bureau's systems and stole personal information on thousands of agents and staff. The group says it accessed the FBIJobs.gov portal and used that foothold to extract between 2 and 3 terabytes of files, including names, home addresses, phone numbers, badge numbers, and details about spouses, according to NBC News.

In a statement, the FBI said it was "aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII)." The bureau added that the point of breach remained undetermined and that it was working with third-party providers supporting the portal to mitigate risk.

ShinyHunters has threatened to publish the stolen data within a week unless the FBI retracts a public service announcement issued in May that the group says contained "disinformation." The group is not demanding money, according to the BBC, but wants the advisory withdrawn.

Current and former FBI agents told BBC News they are fearful and angry about the exposure. One former cyber investigator said agents worry the data could enable phishing, scams, bribery demands, or physical attacks, including "violence-as-a-service" attacks from online gangs. The breach is particularly alarming for undercover agents whose identities could be revealed.

Samples of the data shared with reporters appear genuine and include medical information from fitness-for-work examinations, such as blood and urine test results and doctors' notes. The records relate to thousands of agents, including senior officials such as deputy directors, according to the BBC.

Cynthia Kaiser, former deputy cyber director at the FBI and now at cybersecurity firm Halcyon, said the breach could allow criminals to target or physically harm agents and their families. "A lot of the damage may already be done," she told the BBC, noting that some data is already circulating among cyber researchers.

The hack has raised questions about FBI leadership under Director Kash Patel, whose tenure has faced earlier scrutiny. Former agents expressed frustration over "sloppy and lazy security failures" and said staff were advised to sign up for DeleteMe, a service that removes personal information from data broker sites; a response some considered inadequate.

ShinyHunters, believed to be an English-speaking collective with members worldwide, has previously claimed breaches of Rockstar Games and education platform Canvas. Anthropic said this month it had repeatedly disrupted ShinyHunters affiliates attempting to use its AI in hacking operations.

The FBI is unlikely to comply with the extortion demand, and the group has indicated it will publish the data if the advisory is not retracted. Kaiser warned the hackers to expect "a significant effort by the FBI to quickly bring them to justice."