In a breach that could have far‑reaching consequences for U.S. law‑enforcement personnel, a hacking collective known as ShinyHunters says it has obtained the medical fitness records of thousands of FBI special agents. The stolen files contain blood and urine test results, doctors’ notes on allergies and other health conditions, as well as personal identifiers such as full names, addresses, badge numbers and spouse information.
What was taken?
The leaked data, described by the group as "fitness‑for‑work" examinations, includes:
- Blood and urine test results, with references to conditions like "blood in the urine" and high cholesterol.
- Allergy information, for example a "shellfish and banana allergy".
- Personal details – full name, home address, phone number, badge number and job title.
- Spousal information and, in some cases, details about senior officials such as deputy directors.
According to the hackers, the breach may affect up to around 60,000 current and former FBI staff, a figure that exceeds earlier estimates of 38,000 employees.
How the breach occurred
ShinyHunters claims it exploited a vulnerability in an Oracle cloud storage system used by the FBI. The group says it gained access to multiple internal platforms, including:
- FBIJobs – the portal for job applications and employee records.
- FBI BEAST – the system that handles background checks.
- FBI MedLink – the repository for medical records.
- FBI BICS – a database containing investigative information.
The hackers posted samples of the alleged data on a darknet site and communicated with journalists via Telegram, demanding a retraction of a May FBI advisory that they claim "offended" them. Unlike typical ransomware attacks, they are not asking for money; instead, they threaten to publish the full dataset in five days unless their demand is met.
Potential implications
Experts warn that the permanence of medical data makes the leak especially dangerous. Etay Maor, vice‑president of threat intelligence at Cato Networks, noted that while passwords can be reset, medical records cannot, meaning the information remains compromised indefinitely. Jamie Akhtar, chief executive of CyberSmart, highlighted several risks:
- Highly convincing phishing attacks that leverage personal health details.
- Identity fraud and blackmail using the agents’ medical conditions.
- Impersonation of law‑enforcement officers in targeted operations.
Professor Ciaran Martin, former head of the UK’s National Cyber Security Centre, described the breach as "as serious as it gets when it comes to data breaches" if the claims are verified.
FBI response
The FBI has not provided a detailed comment but confirmed on Wednesday that it is "actively and aggressively investigating" the breach. In a statement posted on X, the agency said it is working with third‑party providers that support FBIJobs.gov to mitigate risk and determine whether the intrusion was a direct hack or the result of a compromised vendor.
Uncertainty and verification
While the BBC has examined samples of the stolen records, some analysts urge caution. The authenticity of the entire dataset cannot be independently verified, and the exact scope of the breach—whether it truly encompasses 60,000 individuals or fewer—remains unclear. Additionally, the FBI has not disclosed whether any of the data has already been used in criminal activity.
Conclusion
The alleged theft of medical fitness records from FBI special agents underscores the growing danger of cyber‑espionage targeting personal health information. If the hackers’ claims hold up, the breach could enable a range of malicious activities, from sophisticated phishing to blackmail, and may force the agency to reassess its data‑protection strategies for both current and former personnel.