The FBI is investigating a cyberattack on its jobs portal after the cybercrime group ShinyHunters said it hacked the system and stole a vast trove of sensitive data from the bureau.
“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the bureau said in a statement on Wednesday. “While the point of breach is still undetermined -whether a third party or the FBI’s enterprise – we are actively and aggressively investigating this matter and working closely with those third party providers that support FBIJobs.gov to mitigate any and all risk.”
In a statement posted to its Dark Web leaks site, ShinyHunters said it had stolen “very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job.” It listed several “FBI services” that it claimed to have hacked: “Criminal Justice (CJ), HR, Medlink, and more.”
ShinyHunters told 404 Media that it hacked into the jobs portal using a zero-day vulnerability in Oracle’s PeopleSoft human resources platform, a tactic it has used before. The potentially wide-ranging breach highlights the supply chain risks facing organisations of all sizes and levels of sophistication. ShinyHunters specialises in supply chain attacks, and its intrusions have illuminated weaknesses in the security protocols at widely used software and infrastructure providers.
404 Media confirmed that a sample of stolen data provided by ShinyHunters included agents’ sensitive personal information. People familiar with the breach described it to Politico as a major counterintelligence failure that could lead to the harassment or stalking of FBI agents. Foreign governments could also use FBI employees’ personal data to monitor them and undermine their investigations and operations.
The FBI’s jobs portal is currently offline and displays a banner explaining that the site is unavailable.
It is unclear whether the PeopleSoft vulnerability that ShinyHunters allegedly exploited is a zero-day or a previously disclosed flaw, such as the one Oracle disclosed in June after ShinyHunters exploited it. Oracle did not respond to a request for comment.
ShinyHunters claimed that it conducted the attack in retaliation for the FBI’s descriptions of the group’s activities in a May bulletin. That advisory “made substantial false allegations,” the group wrote. “We have been severely offended.” ShinyHunters demanded that the FBI “correct or simply remove” the offending lines from its bulletin.
Cynthia Kaiser, a former top FBI cyber security official, said ShinyHunters could wreak havoc on the FBI and its employees if it chose to do so.
“Long term, foreign actors could use the information to target FBI employees and their families for intelligence collection,” said Kaiser, now the senior vice president of the ransomware research centre at the resilience firm Halcyon. “But I’m most worried about the short term potential for physical harm if criminals use this information to target the people who put them behind bars.”
Kaiser pointed to a 2016 breach that led to the theft of personal information belonging to tens of thousands of FBI employees.
“You still occasionally see that list circulated on the Dark Web today,” she said.
Cybersecurity Dive
Ltd
