The cybercriminal group ShinyHunters claims to have breached FBI systems and obtained sensitive data relating to current and former employees, as well as job applicants, according to Hacker News.
Hackers claim to have gained access to multiple FBI systems, including services related to the Human Resources department. The attack was carried out through a previously unknown vulnerability in Oracle PeopleSoft.
ShinyHunters claims that the attack was an act of retaliation for a previous FBI warning, in which the agency linked the group to cybercriminal activities and warned potential victims not to pay the ransom.
The FBI said it was aware of the allegations and was investigating the incident, but has not yet confirmed whether its systems were breached or whether any data was stolen.
Cybersecurity experts point out that, although the group's claims have not been confirmed, the incident highlights the increasing targeting of identity management systems, cloud services and third-party interfaces by modern cybercriminal groups.
Commentary from Jake Moore, Global Cybersecurity Advisor at ESET
“We are increasingly seeing cybercriminals not only pursuing financial gain, but also using hacking as a means of intimidation, while seeking recognition. ShinyHunters specialize in large-scale breaches and are likely to have repeatedly targeted the FBI, looking for any potential vulnerability they could exploit. The theft of the credentials of thousands of FBI employees could be an extremely valuable tool for targeted phishing attacks, and even for intelligence gathering, if this data were to leak onto the dark web. However, for now, this is a claim by ShinyHunters. Therefore, we should be cautious and not give them too much credence.”
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
