By AJ Vicens and Raphael Satter
WASHINGTON, Sept 25 (Reuters) – FBI personnel data recently stolen by the ShinyHunters hackers includes sensitive psychiatric and medical evaluation records, according to the hackers and documents reviewed by Reuters.
ShinyHunters, one of the world’s most notorious and attention-seeking hacking crews, first said it had breached the FBI on Tuesday. In the hack, the group obtained granular details about bureau employees and their assignments, Reuters previously reported, including sensitive work against Chinese spies, Russian intelligence, drug cartels and others.
The breach has already rattled the bureau, but now threatens to turn into a serious counterintelligence risk, said Eric O’Neill, a former FBI operative who founded the cybersecurity consultancy Nexasure AI.
O’Neill said the presence of medical data was a sign that the hack was approaching the same kind of magnitude as the 2015 intrusion into the Office of Personnel Management, which exposed millions of Americans’ sensitive clearance information, allegedly to Chinese intelligence.
He added that the data would be a powerful magnet for hostile spies.
“I would be shocked if Russian intelligence isn’t knocking on their door and saying, ‘We want that stuff, hand it over,'” said O’Neill.
The FBI declined to comment on the records. In a statement issued Wednesday, the bureau said it was “aggressively investigating” the reported breach.
ShinyHunters circulated the medical files to a small circle of reporters earlier this week after announcing it had broken into the FBIjobs.gov site and stolen what it claimed was 2 to 3 terabytes of data.
The BBC earlier on Friday reported that a blood and urine test document was among the sample, but the presence of other sensitive files, including a mental health evaluation and other records, has not previously been reported.
Reuters was able to partially authenticate some of the half-dozen files in several ways, including running two social security numbers in them against credit bureau data, and lining up the date of a pre-employment mental health evaluation against a former FBI analyst’s LinkedIn profile. Reuters also matched the name of an FBI psychiatrist in the document to a LinkedIn profile with the same name and an identical job title.
In one case, Reuters was able to confirm with a person familiar with the matter that a medical professional listed in one of the documents as performing FBI evaluations was in fact doing so at the time, although the person could not authenticate the entire file.
The person spoke on condition of anonymity because they weren’t authorized to discuss the matter.
The psychiatrist and the FBI employees named in the data either did not return messages or declined comment.
DOCUMENTS INCLUDE MEDICAL SPECIFICS
The documents reviewed by Reuters range in sensitivity. One medical record, which was part of a “fitness for duty” exam given to prospective employees, noted that an applicant took aspirin daily and was allergic to dust and cats.
Another record said a potential employee exhibited “symptoms of depression” in high school. A third document carried an electrocardiogram result.
Reuters could not establish whether the limited number of documents viewed were representative of the rest of the data trove held by ShinyHunters, or whether there even were other documents.
An FBI advisory released in May said the group has in the past exaggerated its level of access in an attempt to extort its victims.
ShinyHunters told Reuters on Tuesday the data it had was “very very very sensitive” and included medical information, discharges, prescriptions, clinical visits, and “any health issues with Agents.”
The hackers said they had compromised several of the bureau’s internal services, including the FBI’s background and employee applicant screening system, FBI MedLink, which contains agency personnel medical records, and the FBI’s Background Investigation Contract Services unit. Reuters could not corroborate those specific allegations.
Initially, the group said it would hold the data hostage until the FBI retracted its May advisory, which it said it took exception to. Since then ShinyHunters has removed that defiant statement from its website, saying Thursday it would not comment on what it would do “if the victim does not comply with our kind request.”
(Reporting by Raphael Satter in Washington and AJ Vicens in Detroit; editing by Chris Sanders and David Gaffen)
