• Names
• Home addresses 
• Phone numbers
• Spouse information 

The FBI has confirmed it is investigating the matter but has not said if the claims are true. 

According to ShinyHunters, this attack was not financially motivated; rather, it was in retaliation for a FLASH report on the group’s activity. The group disputed certain claims in the report, particularly of their activities and tactics, and assert the FBI breach was done to force a correction. 

Kevin Kirkwood, CISO at Exabeam, comments, “ShinyHunters demanding that the FBI drop its ‘financially motivated’ characterization sounds like reputation management through intimidation. A particular attack can be driven by revenge or publicity without erasing a history of financial extortion. The group reportedly demanded an eight-figure payment from Clop. That’s an awkward backdrop for protesting the label.

“The distinction is between correcting the record and coercing the author. The FBI should correct any demonstrably inaccurate statement, but a claimed breach does not establish that its assessment of motive was wrong. Demanding a retraction under pressure offers evidence of a desire to control the narrative, not proof that the narrative is false.

“For defenders, the lesson is that money, ego, and retaliation can coexist. The claimed scope of the FBI data theft remains unverified; protecting potentially affected people matters more than accepting the attackers’ preferred description of themselves. Whether the demanded payment is cash or a public correction, stolen information remains the bargaining chip.”

This alleged breach shortly follows news of ShinyHunters engaging in a feud with another cybercriminal gang, Clop. 

Denis Calderone, CTO at Suzu Labs, says, “ShinyHunters has spent the last week picking fights. On Friday they took over Cl0p’s leak site and put up a 'seized by ShinyHunters’ banner, and by Tuesday the same banner was on the FBI’s jobs portal. Both were framed as payback, one for threats from a rival gang and one for an FBI advisory that told victims not to pay them. The FBI hasn’t confirmed anything yet, but if this holds up, it doesn’t look like the ShinyHunters we’ve been seeing all year. Their model has always been breach, extort, then settle or leak, and that only works when the victim can pay. The FBI isn’t going to pay, and it isn’t going to pull an advisory because a criminal group demanded it. Not sure what’s going to happen in a week, but I seriously doubt the FBI will act on this threat.

“They also say this isn’t financially motivated, but I’d take that with a grain of salt. I have a hard time believing terabytes of FBI personnel data just sit on a shelf. Foreign intelligence services would love to have it, and having the FBI on their resume makes every future extortion demand more believable, and if the PeopleSoft zero-day is real, the exploit may be worth more than the data. Meanwhile, agents and their spouses could have their home addresses posted publicly within a week if this threat is followed through.

“That zero-day is where everyone else should focus, since ShinyHunters says they plan to use it more broadly. If you run PeopleSoft, don’t wait for a patch. Get it off the public internet wherever you can, put what has to stay public behind a WAF, and make sure admin components like the /PSEMHUB/ path in their screenshot aren’t reachable from outside. Hunt for the June indicators and for SSH attempts against the psoft and oracle accounts. Then ask yourself what your applicant portal can reach. At the FBI, a website built for strangers to upload resumes allegedly led straight into GovCloud.”

“Limiting your blast radius is the best precautionary play here.”