ShinyHunters says it is holding FBI personnel data hostage, and a Reuters review shows the sample it released goes well beyond routine HR records. ShinyHunters announced Tuesday that it breached the bureau and took data on a large number of current and former employees. The group says it will not return the data until the FBI rescinds an unflattering statement about it issued in May.

The 5,000-line spreadsheet, which the hackers describe as only a small piece of their claimed haul, covers what they say are thousands of FBI employees. Beyond personal identifiers, it lists assignments to specific field offices and, in some cases, to sensitive units.

Reuters found:

• 14 staffers tied to China-related matters, including:
  • the "China criminal enterprise unit" 
  • the "China tech transfer analysis unit" 
  • the "China intelligence section." 

• 9 are listed in Russia-related roles, 
• 3 in Iran- or Hezbollah-focused intelligence work,
• 18 appear in intercept, "clandestine technical operations," "covert access section," or surveillance roles, 
• 11 are listed in human intelligence (HUMINT) jobs.

Reuters has not authenticated the entire spreadsheet. It did individually verify the details of more than 22 people by cross-referencing the data with credit records and earlier leaks carried by the dark web intelligence platform District 4 Labs. 

It also matched the career details or titles of eight people to court filings, news articles and public profiles such as LinkedIn. Reuters could not confirm that every job assignment is authentic or current.

Former FBI counterintelligence operative Eric O'Neill, founder of Nexasure AI, called the data "a foreign intelligence service goldmine" and said China would want to know who is working against it. O'Neill cautioned against drawing conclusions about what else the hackers hold, saying they are "really trying to scare the hell out of the FBI."

Trevor Hilligoss, chief intelligence officer at SpyCloud, said tying named people to human intelligence work is especially troubling. He also flagged the emergency contacts, often spouses or children, who "may have less operational security knowledge."

The FBI said it is aware of "a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal" and is "actively and aggressively investigating." It says the cause of the breach is still undetermined. 

ShinyHunters says it will release no further FBI data and that if the sample leaks, "it's not because of us."

ShinyHunters recently claimed it hacked the FBI and stole personal data on the agency's entire workforce due to a May advisory where the bureau said the threat actor sometimes uses exaggerated access claims to pressure victims into paying. 404 Media reviewed a sample of roughly 5,000 alleged agent records and discovered some numbers belonged to Department of Justice personnel.

Recently, ShinyHunters said it hacked rival Cl0p's dark web leak site in a ransomware gang feud over Oracle flaw exploits. The group’s most recent targets include the Florida DMV, a McKesson-confirmed breach, Inter-Con Security, and CyrusOne.