Special agents blood and urine test results stolen in FBI hack

A hacking group claims to have stolen highly sensitive medical records belonging to thousands of FBI special agents, in a breach the bureau says it is "aggressively investigating," according to BBC News.

The stolen material reportedly includes results from "fitness-for-work" medical evaluations, such as blood and urine test findings, along with doctors' notes referencing conditions like allergies, high cholesterol and blood in urine, BBC News reported after reviewing samples of the leaked data. The files also allegedly contain agents' full names and home addresses.

The hacking collective, known as ShinyHunters, says it broke into FBI systems earlier this week and has since posted details of the intrusion on a darknet website, according to the BBC. The group reportedly shared sample records with journalists, which also included phone numbers, badge numbers, job titles, and details about agents' spouses. Some of the affected individuals are said to include senior FBI officials, such as deputy directors.

Cybersecurity experts quoted by the BBC warned that the breach could expose agents to blackmail, scams and impersonation attempts, in addition to helping criminals pose as law enforcement officers. Etay Maor of Cato Networks noted that unlike passwords, medical records cannot be changed once exposed, meaning the damage from such a leak is effectively permanent.

Unlike many cybercriminal groups, ShinyHunters is reportedly not demanding a ransom payment. Instead, the group says it wants the FBI to retract a security advisory it published in May, which the hackers claim they found offensive, according to the BBC.

The scale of the breach remains unclear. It was initially believed to affect the FBI's roughly 38,000 current employees, but the hackers have since claimed the true number of affected current and former staff could be closer to 60,000, the BBC reported.

Reuters has reported that some of the exposed data relates to agents involved in investigations tied to Russia, China and drug cartels, while separate reporting by 404 Media suggested that information about a little-known FBI hacking unit may also have been compromised.

According to the BBC, ShinyHunters claims it gained access by exploiting a vulnerability in an Oracle cloud storage system used by the FBI, which reportedly allowed entry into several internal platforms. These are said to include the FBI's job application system, a background-check platform for employees and applicants, a system storing medical records, and a database containing investigative information.

The FBI has not directly responded to media requests for comment, the BBC said, but confirmed on social media platform X that it was investigating the incident. The bureau said it was still working to determine whether its own systems were breached directly or whether the intrusion originated through a third-party contractor that supports its online job application portal. It added that it was coordinating with those third-party providers to reduce any further risk.

Ciaran Martin, former head of the UK's National Cyber Security Centre, described the breach — if verified — as among the most serious data breaches possible, according to the BBC. Jamie Akhtar, chief executive of CyberSmart, cautioned that the hackers' claims should be treated carefully but said the apparent breach raised serious concerns about potential phishing, identity fraud and targeted operations against law enforcement personnel.

ShinyHunters is described by the BBC as an international hacking group active since 2019, previously linked to cyberattacks on companies including Rockstar Games and the education platform Canvas. The group has reportedly threatened to publish the full dataset within five days unless its demands are met.