FBI Agents' Sensitive Medical Data Allegedly Stolen in ShinyHunters Breach
Extortion group ShinyHunters claims to have breached the FBI, allegedly stealing sensitive medical records of agents, including blood test results and doctors' notes, and is demanding the FBI retract an advisory.
The FBI is investigating a data breach that has reportedly exposed the highly sensitive medical records of its agents, including detailed fitness-for-work reports, blood test results, and doctors' notes. The extortion group ShinyHunters has claimed responsibility for the attack, stating it was a retaliatory measure against the FBI for an advisory the group deemed false and defamatory.
BBC News has reportedly seen samples of the stolen data, which include personal details such as names, addresses, phone numbers, badge numbers, and job titles. More alarmingly, the samples allegedly contain intimate medical information, such as results from blood and urine tests, and notes detailing conditions like high cholesterol, blood in the urine, and even allergies. This type of information, unlike a compromised password, cannot be changed, leaving affected individuals vulnerable long-term.
ShinyHunters claims to have accessed multiple FBI systems, including FBI MedLink, which is believed to store medical records, and FBI BEAST, a system used for background checks. While the FBI has confirmed an incident affecting systems related to FBIJobs, it has not yet confirmed the specific systems compromised or the full extent of the data exfiltrated.
The group's demands are non-financial. ShinyHunters is calling for the FBI to retract or remove a May advisory that the group claims is false and damaging to its reputation. The attackers have set a deadline, threatening to release the sensitive data on approximately 60,000 current and former FBI staff if their demands are not met within five days.
This incident marks a significant escalation in the tactics of groups like ShinyHunters, moving beyond financial extortion to leverage highly personal data for leverage. The potential impact on the affected agents and their families is profound, raising concerns about privacy, personal security, and the potential for future misuse of this sensitive information.
The FBI has advised individuals who may be affected—current or former employees, their relatives, or applicants—to monitor FBI.gov for official updates and guidance. Recommended actions include changing passwords for any FBI Jobs accounts and reusing them elsewhere, enabling two-factor authentication (preferably with a FIDO2-compliant hardware key), and remaining vigilant against potential impersonation attempts or phishing scams.
Furthermore, the FBI is urging individuals to consider setting up identity monitoring services. These services can alert individuals if their personal information appears on the dark web or is being traded illegally, and can assist in recovery efforts should identity theft occur. The breach underscores the persistent threat posed by sophisticated threat actors and the critical need for robust cybersecurity measures and ongoing vigilance.
The new article reveals that the Dutch police arrested Pepijn van der Stap, also known as 'Umbreon,' on suspicion of aiding the ShinyHunters group. Following his arrest, ShinyHunters escalated attacks, notably stealing data from the FBI and extorting the Cl0p ransomware group, and claimed to exploit a zero-day vulnerability in Oracle's PeopleSoft platform (CVE-2026-35273).
Mandiant has issued a warning that the ShinyHunters threat group is actively exploiting a vulnerability in Oracle PeopleSoft products, specifically targeting and bypassing existing workarounds. This campaign follows ShinyHunters' recent claim of responsibility for an attack on the FBI's jobs website, indicating a pattern of targeting high-profile organizations and potentially leveraging newly discovered exploitation techniques.
The Dutch police have arrested Pepijn van der Stap, a 24-year-old convicted hacker previously associated with the ShinyHunters extortion group. Van der Stap, who used the handle "Umbreon" and was recently employed as an offensive security lead, was arrested on September 16th while on supervised release from a prior sentence. This arrest is reportedly linked to the FBI's investigation into ShinyHunters, with the group's current leader allegedly pinning the FBI jobs site hack on him.
Dutch police have arrested a 24-year-old man in Amsterdam in connection with the ShinyHunters hacking group, with the individual expected to appear before a judge on September 29, 2026. Independent reporting has identified the suspect as Pepijn van der Stap, also known as Umbreon, who was previously apprehended in 2023 for data theft and extortion activities and is currently employed as an offensive security lead at Neo Security.
Dutch authorities have arrested a 24-year-old man in Amsterdam, identified by cybersecurity journalist Brian Krebs as Pepjin van der Stap, who is alleged to be a leader within the ShinyHunters group. This arrest is a significant development in the ongoing investigation into the group's extensive extortion activities, which have targeted over 140 organizations since 2025 and reportedly netted at least $70 million. The FBI has indicated that this arrest is a step towards dismantling the group, with Assistant Director Brett Leatherman issuing a direct warning to other ShinyHunters members.
The alleged leader of the ShinyHunters extortion group, identified as Saif al-Din Khader, also known as Rey, has reportedly been arrested in Jordan. Khader, who is also linked to the Scattered Lapsus$ Hunters group, is reportedly cooperating with the FBI to identify other members of ShinyHunters. This arrest follows a recent hack and defacement of the FBI's jobs site, FBIJobs.gov, by ShinyHunters, who claimed to have stolen terabytes of data.
The detention of Saif al-Din Khader, a 16-year-old suspected member of ShinyHunters, in Jordan and his cooperation with the FBI marks a significant development in the ongoing investigation into the group. This follows the recent arrest of another alleged ShinyHunters member, "Umbreon," in Amsterdam, who is suspected in breaches of Pornhub and Ticketmaster. The FBI has indicated that more arrests are anticipated as they continue to pursue leads against the cybercrime organization.
The FBI has reportedly detained a second individual, Saif al-Din Khader, in Jordan in connection with the ShinyHunters data breach. Khader, identified as an alleged key figure within the group, is reportedly cooperating with law enforcement to help locate other members. This development follows the recent arrest of another alleged ShinyHunters member, Pepijn van der Stap, who was reportedly in a power struggle with Khader for control of the operation.