SACHA PFEIFFER, HOST:
A group of cybercriminals has stolen reams of data from one of the key agencies tasked with investigating cybercrime, the FBI. NPR cybersecurity correspondent Jenna McLaughlin has been reporting on the ongoing investigation of this theft, and she's with us in the studio. Hi, Jenna.
JENNA MCLAUGHLIN, BYLINE: Hey.
PFEIFFER: Hacks are sadly common these days, but for the FBI to be hacked sounds quite concerting. How alarming - how alarmed should we be?
MCLAUGHLIN: Yeah, it's not great. But in all seriousness, it's most concerning if you're a current or former FBI employee. The target in this case was the FBI jobs portal. So it's not the entire FBI. It's not confidential informants or ongoing operations or confidential information.
PFEIFFER: Do we know what was stolen?
MCLAUGHLIN: We do. So I'm hearing that there were several terabytes of text files that were stolen. It's a lot of data on FBI personnel. It's not just job applications, but it's also promotions data. Those files include sensitive details about previous postings, medical information, family names. One of the last times we saw something like this happen was the 2015 breach of the Office of Personnel Management. The U.S. government has attributed that to the Chinese government stealing millions of sensitive records, from security clearance details to fingerprints and espionage efforts.
But this is different because these are cybercriminals, and they have a reputation for extorting and leaking stolen files. They say now that they don't have a plan on publishing this information, that their goal was to get the FBI to correct the record on public statements they've made about these hackers. But they've already given parts of it to reporters, and the FBI sources that I talk to are pretty much assuming that the data's out there and that the bad guys around the world will be committed to stealing it from ShinyHunters.
PFEIFFER: And then, based on the conversations you've been having with people at the FBI, how are they feeling about knowing that's out there?
MCLAUGHLIN: Not great. I've been talking to current and former FBI sources since last week. They, of course, aren't authorized to speak on the record about this. And the mood's grim. I'd say that there's more anger and frustration than panic because these people are used to dealing with emergencies. It's kind of what they do. There's some dark humor. They've been passing around memes. But I think the frustration is mostly directed right now at the leadership of the FBI, Director Kash Patel. They feel like there hasn't been a lot of communication about how the bureau is going to protect current and former employees.
A few people have been notified that their data might have been stolen, but many are still out there wondering. There's actually a community of former employees who are sort of banding together, figuring out how they can help each other if this data gets out.
Publicly, the FBI said they're aggressively investigating the point of the breach and mitigating the damage. The Dutch police actually arrested a member of this group in Amsterdam earlier in September, though they just publicly announced it. The FBI posted this kind of unusual video on social media about working with the Dutch where Brett Leatherman, the FBI assistant director for the Cyber Division, he's kind of taunting this group, the ShinyHunters, in a bid to get them to come forward with information. Take a listen.
(SOUNDBITE OF ARCHIVED RECORDING)
BRETT LEATHERMAN: You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.
PFEIFFER: So if the FBI has already been hit, is there concern that other government agencies are vulnerable too?
MCLAUGHLIN: Absolutely. So in this case, the FBI is not the only one that's vulnerable. There are other bad guys out there besides ShinyHunters who are looking to exploit a specific vulnerability that was potentially used to access this system. According to new research from Google, there appears to be a widespread compromise of third-party software called PeopleSoft. It's a company that was acquired by the tech giant Oracle in 2005. Their clients are all the big names - big retailers, government agencies, you name it. Long story short, it was first targeted over the summer. The company put in place some protections. They didn't fully fix the problem. Now the bad guys are hitting dozens of systems all over the world.
PFEIFFER: Thanks for covering this. That is NPR's Jenna McLaughlin.
MCLAUGHLIN: Thank you. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
