By Sean Lyngaas, Evan Perez, CNN
(CNN) — A week after a cybercriminal group claimed to steal sensitive personal data on thousands of current and former FBI employees, the bureau is still assessing the extent of the damage while facing internal criticism about the agency’s handling of the incident.
It’s one of the most serious breaches of agency data in years, but some FBI employees have felt left in the dark about whether they’re affected and underwhelmed by the security resources being offered to victims, according to current and former officials.
“Management is lost,” one ex-FBI agent in touch with their former colleagues told CNN. “They’re not providing any clear advice to agents.”
The issue began a week ago, when hackers broke into an online portal hosting information on FBI job applicants. Social Security numbers, emergency contact information and personal addresses were in the stolen data.
The hackers demanded that the FBI amend a previous advisory issued about the group, saying it was “offended” over how the agency described its alleged tactics for extorting victim organizations.
Many at the FBI and within the cybersecurity industry took the demand as a tacit threat that the hackers would leak the stolen data. (The cybercriminal group now claims that it never planned to publish any of the stolen data, but they have a history of doing so with other victims.)
The hackers responsible, known as ShinyHunters, have previously targeted “major companies across tech, finance, and retail, often stealing millions of customer records at once,” according to the FBI’s advisory on the group.
In this case, the stolen data includes information on FBI personnel working in sensitive units focused on China and Russia, among other topics, according to sources who have seen the data.
On Tuesday, the FBI announced that Dutch authorities arrested “one of the alleged leaders of ShinyHunters.”
“Dutch authorities were ready to act. With our full support, they moved quickly to protect victims and preserve critical evidence,” Brett Leatherman, assistant director of the FBI’s cyber division, said in an Instagram video. He said the alleged leader and his co-conspirators breached over 140 organizations since last year.
Dutch authorities said in a statement that the alleged leader is 24 years old and was arrested on September 15, after which authorities found additional information on his laptop.
He will remain in pretrial detention for at least another 90 days, according to the authorities.
Breach raises concerns
An FBI spokesperson said the bureau has communicated with employees throughout the incident response process.
“FBI employees potentially impacted have received communication and notification multiple times within the last week, as recently as Saturday,” the spokesperson said.
After discovering the hack, the FBI “immediately responded through a multi-division effort, all meant to prioritize incident response, pursuing the alleged actors and data, engaging employees and partners, etc,” the spokesperson said. “The teams have been working 24/7 on all of it.”
The breach was alarming news for the FBI agents who rely on relative anonymity to work the front lines of counterintelligence, terrorism and cybercrime. Some agents are worried that their home addresses could be made public, potentially posing a safety issue for their family while they are traveling, according to sources familiar with the matter.
The far-reaching extent of the breach has also raised serious counterintelligence concerns. Officials fear that detailed personal data stolen by the hackers could be used along with other information compromised in earlier breaches to identify agents in sensitive jobs, according to multiple people briefed on the investigation.
Foreign government adversaries or drug cartels could use the information — were they to acquire it — to try to identify agents who are working undercover or are assigned specific roles that are of interest to them. The FBI will have to try to mitigate safety risks to those employees, the sources say.
Adversaries have weaponized FBI data before. A Mexican drug cartel hired a hacker to surveil the movements of a senior FBI official in Mexico City in or around 2018, gathering information from the city’s camera system that allowed the cartel to kill potential FBI informants, according to a Justice Department inspector general report made public last year.
On Friday, the FBI sent an email to the workforce about the incident emphasizing the bureau’s commitment to the safety of employees and their families, according to people familiar with the message. It encouraged employees to report any safety or security concerns to FBI security personnel. The bureau is operating under the assumption that the hackers have stolen data on all FBI employees, the message said. (The New York Times first reported on the email.)
It’s a blow to one of the nation’s premier cybercrime-fighting organizations, which is often called to help clean up hacks at Fortune 500 companies.
The FBI’s cyber, security and victim services divisions are all involved in the response to the hack, according to people familiar with the matter. The goal is to give each employee the resources they need to deal with any threats from the hackers.
But, at least initially, some in the workforce didn’t feel they had access to those resources. FBI agents have turned to agency rumor mills to try to find answers about the breach that leadership haven’t provided, one source said.
This story has been updated with additional information.
The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.
