The US Federal Bureau of Investigation has confirmed a major data breach, as a result of which hackers gained access to confidential information about thousands of current and former FBI staff members. The incident was caused by a critical security patch on the platform, which was maintained by a third-party company, failing to be applied in a timely manner. Following an internal investigation, the FBI suspended the contractor responsible.<\/p>\n
According to the head of the FBI\u2019s cyber unit Brett Leatherman<\/strong>, an internal investigation found that the incident was caused by a security breach on a platform managed by a third-party organisation. According to him, the contractor responsible has not installed a security update released specifically for this purpose<\/strong>, which was intended to fix the vulnerability.<\/p>\n Reuters sources identified this platform as Oracle PeopleSoft<\/strong> \u2014 a human resources management system linked to the FBI\u2019s recruitment portal. Accenture was responsible for maintaining the platform. The company confirmed that it continues to work with the FBI, but did not comment in detail on the situation regarding the specific employee.<\/p>\n The scale of the data breach turned out to be far more serious than a routine theft of contact details. Among the compromised data were job descriptions of counter-intelligence staff, home addresses of individuals linked to intelligence operations, and medical and psychiatric records of FBI staff<\/strong>.<\/p>\n It had previously been reported that social security numbers, information about family members and other personal data had been compromised. Once the scale of the attack had been established, the FBI assumed the worst-case scenario \u2014 that the data of all staff could potentially have been compromised, until an investigation proved otherwise.<\/p>\n For a law enforcement agency of this calibre, such a data breach is particularly dangerous: personal data could be used for surveillance, blackmail, phishing attacks or to identify individuals working on sensitive investigations.<\/p>\n A hacker group claimed in September to have breached the FBI\u2019s systems ShinyHunters<\/strong>. The hackers claimed to have obtained a large amount of information about current and former employees of the bureau. The FBI subsequently launched its own investigation and took steps to protect its systems and staff.<\/p>\n One of the suspected members of ShinyHunters was later arrested in Jordan. He is cooperating with the investigation and has granted the police access to some of his devices and communications.<\/p>\n Oracle had previously issued warnings regarding PeopleSoft vulnerabilities and urged customers to install updates promptly. Google has also documented campaigns in which attackers exploited vulnerabilities in this platform.<\/p>\nAmong the items stolen were agents\u2019 addresses and medical records<\/h2>\n
ShinyHunters claimed responsibility for the attack<\/h2>\n
Oracle had warned of the problem earlier<\/h2>\n