Garrett Graff writes:

In what might turn out to be the gravest intelligence breach of the FBI in history — and perhaps one of the worst in all of US history — a criminal hacking group is claiming to have compromised the bureau’s hiring and personnel records. The group, known as ShinyHunters, appears to have “exfiltrated” data on perhaps tens of thousands of current and former FBI employees, both agents and not, perhaps even effectively everyone who has been hired by the bureau in recent years. “We hacked the FBI. We hold data on all FBI employees and applicants,” the group told 404 Media.

The threat of a breach this massive is almost incalculable — and could destroy or undermine a generation of agents who work undercover or on assignments like counterintelligence. It’s not entirely clear what the breach includes, but preliminary information from the hackers seems to indicate it includes everything from home addresses and Social Security numbers to potentially even medical records. News organizations like 404 Media have been able to authenticate that at least some of the data lines up with actual FBI employees. Reuters and the BBC have seen other documents that include mental health evaluations and blood and urine test results.

Ciaran Martin, who used to head the UK’s National Cyber Security Centre (NCSC), and who is not normally known for his hyperbole, told the New York Times that the hack could have a “huge impact” on the bureau, given the uncertainty of where the data might end up, and might ultimately come at a higher operational cost than China’s also-devastating hack of the federal personnel records of the Office of Personnel Management. “Losing the data on 20 million federal employees to the Chinese was bad,” Martin told the NYT. “But you knew the Chinese weren’t going to sell or publish it.”

In the last 24 hours, the hacking group sent out statements saying it was backing away from publishing the data it stole — the BBC’s Joe Tidy says perhaps the group is “simply now regretting hacking the world’s biggest police force” — but if this information is out there, even if it’s never published, you can be sure that adversaries like China, Russia, and Iran are hungry for it, and would potentially be willing to pay top dollar for it. [Continue reading…]