Current and former FBI agents have spoken to BBC News of their shock, fear and anger following a hack that appears to have exposed the private and personal information of the agency's entire workforce. "This is really bad for our undercover agents," says one former FBI agent, who fears for the safety of his colleagues. The former cyber investigator is in a group chat with current agents who are worried their personal information could soon be freely available online to criminals and hostile nation-state hackers.
He says staff fear they could be targeted, or that criminals could use the data to create highly convincing phishing attempts, scams or demands for bribes. The hacking group ShinyHunters is threatening to publish the stolen databases and documents within four days unless its demands are met. Some agents are also concerned about the risk of physical attacks from cyber criminals they have investigated.
"One of the things we are discussing in the group chat is 'violence-as-a-service' attacks from young online gangs," says the former worker. "They could use this information to harass an FBI agent who has worked on their cases." Groups similar to ShinyHunters - believed to be an English-speaking gang - have in the past been linked to swatting incidents, and even petrol bomb attacks against law enforcement officers and rivals. Swatting is a phenomenon so-called because perpetrators make calls that prompt armed police units - called Swat teams in the US - to swoop in on victims.
The group claims it breached FBI systems on Monday and later posted details of the attack on its darknet site. The FBI has not responded to requests for comment. However, on Wednesday the agency acknowledged the breach - saying it was "aggressively investigating" how it occurred.
For Michael McPherson, a former FBI agent who is now senior vice president of security operations at cyber firm ReliaQuest, the hack presents "a security threat which cuts to the core of agent safety, particularly their families". He says agents understand the "inherent risks" that come with the job. "But this incident reportedly includes personal data such as home addresses and contact information, which could expose family members who are normally insulated from the threats associated with such a career," McPherson says.
ShinyHunters shared samples of the alleged stolen data with reporters, along with an extortion demand. The samples appear genuine and include names, addresses, phone numbers, badge numbers, job titles and information about spouses. The records appear to relate to thousands of agents, including senior officials such as deputy directors.
Extract — continue reading at the source.
