Current and former FBI agents have expressed shock and concern after a cyberattack allegedly exposed sensitive personal information belonging to thousands of agency employees.
The hacking group ShinyHunters claims it breached FBI systems and is threatening to release the stolen databases and documents unless the agency meets its demands.
A former FBI cyber investigator told the BBC that current agents are worried their personal information could end up publicly available and be exploited by criminals or hostile foreign actors.
The stolen information reportedly includes names, home addresses, phone numbers, badge numbers, job titles and details about spouses. Samples reviewed by the BBC also appear to contain sensitive medical records from fitness-for-work examinations, including test results and doctors’ notes.
The potential exposure has raised concerns about phishing, blackmail, harassment and physical attacks against agents and their families. Former FBI official Michael McPherson said the alleged inclusion of home addresses and contact details could put relatives at risk.
There are also concerns over national security, with experts warning that exposed information could potentially be used by foreign intelligence services to target or recruit FBI personnel.
The FBI said it was “aggressively investigating” the incident but has not publicly detailed how the breach occurred.
Some former agents have criticized the agency’s security practices, particularly because ShinyHunters is not generally viewed as one of the most technically sophisticated hacking groups.
The group has reportedly shared samples of the alleged stolen information online and says it plans to publish more. Unlike many ransomware operations, its demand is not primarily financial. It wants the FBI to withdraw an advisory published in May that the group claims offended its members.
The incident could create further pressure on FBI Director Kash Patel, whose leadership has already faced scrutiny. Former agents have also questioned how such sensitive information could have been exposed at a major US law enforcement agency.
Experts warn that even if the FBI prevents the full database from being published, some of the information may already be circulating among online criminal and cybersecurity communities, potentially creating long-term risks for affected personnel.
