Inside the FBI hack: Agents fearful and angry after 'dangerous' data breach. Joe Tidy - Cyber correspondent, BBC World Service Fri, September 25, 2026 at 4:05 PM PDT Current and former FBI agents have spoken to BBC News of their shock, fear and anger following a hack that appears to have exposed the private and personal information of the agency's entire workforce. "This is really bad for our undercover agents," says one former FBI agent, who fears for the safety of his colleagues. The former cyber investigator is in a group chat with current agents who are worried their personal information could soon be freely available online to criminals and hostile nation-state hackers. He says staff fear they could be targeted, or that criminals could use the data to create highly convincing phishing attempts, scams or demands for bribes. The hacking group ShinyHunters is threatening to publish the stolen databases and documents within four days unless its demands are met. Some agents are also concerned about the risk of physical attacks from cyber criminals they have investigated. "One of the things we are discussing in the group chat is 'violence-as-a-service' attacks from young online gangs," says the former worker. "They could use this information to harass an FBI agent who has worked on their cases." Personal concerns. Groups similar to ShinyHunters - believed to be an English-speaking gang - have in the past been linked to swatting incidents, and even petrol bomb attacks against law enforcement officers and rivals. The group claims it breached FBI systems on Monday and later posted details of the attack on its darknet site. The FBI has not responded to requests for comment. However, on Wednesday the agency acknowledged the breach - saying it was "aggressively investigating" how it occurred. For Michael McPherson, a former FBI agent who is now senior vice president of security operations at cyber firm ReliaQuest, the hack presents "a security threat which cuts to the core of agent safety, particularly their families". He says agents understand the "inherent risks" that come with the job. "But this incident reportedly includes personal data such as home addresses and contact information, which could expose family members who are normally insulated from the threats associated with such a career," McPherson says. ShinyHunters shared samples of the alleged stolen data with reporters, along with an extortion demand. The samples appear genuine and include names, addresses, phone numbers, badge numbers, job titles and information about spouses. The records appear to relate to thousands of agents, including senior officials such as deputy directors. The criminals also appear to possess highly sensitive medical information relating to thousands of special agents. BBC News has seen samples of stolen "fitness-for-work" medical examinations containing information such as blood and urine test results, along with doctors' notes mentioning conditions including a "shellfish and banana allergy". Agents' full names and addresses, as well as references to medical issues including "blood in the urine" and "high cholesterol" are now in the criminals' hands. Cynthia Kaiser, who was the Deputy Director of Cyber at the FBI and now leads the Research Centre at Halcyon says ShinyHunters appear to already have lost control of some of the data which is circulating in various online groups of cyber researchers and could lead to harm even before the main tranche is published. "A lot of the damage may already be done, and as we have seen in past FBI data breaches, that information continues to circulate the dark web years later," she said. There are also concerns about the breach's national security implications, such as staff becoming targets for recruitment efforts by hostile foreign intelligence services. Fallout fears. Alongside fear, many of those who spoke to the BBC expressed anger at the FBI for allowing the data to be stolen. The hack is particularly embarrassing from a technical perspective because ShinyHunters is not generally regarded as a highly sophisticated hacking group. One former cyber agent said FBI staff were furious about the "sloppy and lazy security failures" that allegedly enabled the breach. There is also confusion about how to handle any fallout if data is published next week, as threatened. The FBI appears unlikely to comply with the extortion demands, and the hackers have indicated they intend to post the information on their darknet site. Unusually, the group is not demanding money. Instead, it wants the FBI to retract an advisory published in May, which it claims "offended" them. "The agency leadership is lost," the former cyber investigator tells me. He says staff have been advised to sign up to a service called DeleteMe, which helps remove personal information from data broker websites - a response he feels is inadequate. According to another former agent, there is widespread shock that such a breach could happen at one of the world's best-resourced law enforcement agencies. "You would think this information would not be internet-exposed. It's disturbing, actually," he says. 'Kicked a sleeping lion' There is also embarrassment that a prolific group of young cyber criminals has repeatedly managed to evade law enforcement while carrying out a string of high-profile hacks. ShinyHunters has been linked to numerous extortion attacks, including on Rockstar Games and the education platform Canvas. The group regularly communicates with reporters via Telegram, where members often boast about their activities. "The bureau doesn't know what to do with teenage cyber criminals," one former agent says. McPherson says there is no doubt the FBI is taking the incident extremely seriously. He expects the agency to draw on its extensive network of partners and resources "to make this group suffer the consequences for this brazen and taunting attack". Kaiser added that the hackers have been "reckless and foolish" and warned them to expect "a significant effort by the FBI to quickly bring them to justice."

ReliaQuest CEO Brian Murphy revealed that the Tampa-based cybersecurity firm's agentic-AI security platform, GreyMatter, autonomously resolved 81 million investigations across 1,500 customers in the past year. The company, which was bootstrapped for nine years, has surpassed $400 million in recurring revenue. Murphy told Jon Fortt that ReliaQuest is "marching toward" an initial public offering but won't rush to time the market. The CEO, who was raised in small-town Florida, is a Florida State graduate.

Cybersecurity brief - 2026-08-25. 2026-08-25 Major Incidents or Breaches * Iran-linked hackers were responsible for shutting down a UK power plant for four days, causing significant operational disruption and raising concerns about the resilience of the UK's distributed energy infrastructure [[35]]. * Apollo Global, a private equity firm, experienced a data breach that exposed personal information as part of a campaign targeting major financial companies [[33]]. * ReliaQuest confirmed that an employee was targeted in a phishing attack following the ShinyHunters breach. Attackers gained access to a dashboard, but the impact was limited and no data theft occurred [[15]] [[28]]. * A breach at South Korea's government-backed startup platform exposed encrypted personal data due to an encryption key being included in an API, highlighting key management failures [[17]]. Newly Discovered Vulnerabilities * A maximum-severity vulnerability (CVE-2026-21962) in Oracle HTTP Server and Oracle WebLogic Server is being actively exploited, allowing unauthenticated attackers to access critical data. CISA has added the flaw to its Known Exploited Vulnerabilities catalog [[3]] [[27]]. * The Zimbra Collaboration Suite is affected by an actively exploited vulnerability (CVE-2026-73570) that allows full takeover of user communications. CISA has mandated a three-day patch deadline for US government agencies [[19]] [[21]]. * Red Hat and the Keycloak project patched a critical password reset flaw that could allow unauthenticated remote attackers to take over any account on the open-source identity and access management server [[8]]. * Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress are being targeted by attackers, enabling the forging of SAML responses and unauthorized admin access [[13]]. * An unpatched flaw in Calix GS7 XGS (GS5239XG) residential routers allows remote attackers to bypass NAT and expose internal devices by creating port-forwarding rules [[12]]. * The Spring Application Framework has received patches for 91 vulnerabilities, with more than 200 vulnerabilities patched so far this year, compared to 16 in 2025 and 22 in 2024 [[31]]. Notable Threat Actor Activity * The Chinese-speaking cybercrime group UAT-10147 is targeting Windows and Linux web servers globally across education, media, technology, and government sectors. The group uses AI to scale attacks, deploys SPECTRE malware with EDR bypass, and leverages a Linux rootkit [[11]]. * Operation QUICSILVER is a cyber espionage campaign targeting Myanmar government and IT sectors using graduation ceremony invitation lures to deliver a Go-based backdoor called QUICAgent [[9]]. * Threat actors are distributing the Weedhack malware to gamers by disguising it as fake Minecraft clients and leveraging SEO poisoning [[5]]. * Multiple campaigns are using new malware families, including WordlistLoader and SynkLoader, to deliver infostealers and steal Windows credentials. These tools are being used to sell access to ransomware groups and employ techniques such as screen hijacking [[7]] [[22]] [[23]]. Trends, Tools, or Tactics of Interest * AI chatbots have been shown to be more effective than human scammers at building trust in social engineering attacks, particularly in romance scam scenarios [[1]]. * AI-enabled social engineering is increasing the effectiveness of attacks, accounting for over 85 percent of cyber insurance losses in the first half of the year [[2]]. * The rapid adoption of AI coding tools is increasing remediation debt as more code is shipped than can be effectively secured [[4]]. * Only a small percentage of AI users present disproportionate security risks, particularly those using advanced AI tools for custom development and automation [[10]]. * AI is accelerating vulnerability discovery, outpacing the rate of remediation, and tightening the window between disclosure and exploitation [[25]] [[34]]. * Malware campaigns are leveraging trending topics and fake software downloads, such as fake GTA 6 demo sites, to distribute infostealers targeting browser-stored credentials [[39]]. * Fake Microsoft security scans are being used to trick victims into uninstalling antivirus software, facilitating refund scams [[40]]. * The latest version of the ToxicPanda Android banking trojan has expanded capabilities to seize control of infected devices, block access to Google Play, and threaten enterprise environments [[24]] [[43]]. * AliExpress was found using silent audio processing as a browser fingerprinting technique, bypassing traditional cookie-based tracking [[42]]. Regulatory or Policy Developments Affecting the Security Industry * TikTok, ByteDance, and affiliates reached a $400 million settlement with the US Department of Justice over alleged violations of the Children's Online Privacy Protection Act (COPPA) [[14]] [[36]]. * The Dutch Data Protection Authority fined Uber nearly $1 billion for violations of the EU's General Data Protection Regulation related to automated suspensions of driver accounts [[30]]. * Microsoft Teams introduced a policy allowing administrators to block all identified external bots from joining meetings, enhancing meeting security [[16]]. [[1]]: Report: AI Chatbots Are More Effective at Building Trust Than Human Scammers [[2]]: Human Error Remains at the Core of AI-Enabled Social Engineering [[3]]: Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data [[4]]: Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt [[5]]: Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning [[7]]: WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords [[8]]: Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account [[9]]: Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor [[10]]: The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk [[11]]: UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit [[12]]: Unpatched Calix flaw lets hackers bypass NAT to expose internal devices [[13]]: Hackers target WordPress sites in miniOrange auth bypass attacks [[14]]: TikTok reaches $400M settlement with US over COPPA violations [[15]]: ReliaQuest confirms failed data-theft attack after ShinyHunters breach [[16]]: Microsoft Teams now lets admins block external bots from meetings [[17]]: South Korean startup platform breach exposes key management failures [[19]]: CISA orders urgent patching of actively exploited Zimbra flaw [[21]]: Exploited Zimbra Flaw Highlights Shrinking Window to Patch [[22]]: Foul Language: WordlistLoader Disguises Malware as Ordinary Text [[23]]: Tricky 'SynkLoader' Multitool May Herald Ransomware [[24]]: ToxicPanda Banking Trojan Matures Into Enterprise Threat [[25]]: The Vulnerability Gap: Why Discovery Is Outrunning Repair [[27]]: CISA Warns of Exploited Oracle WebLogic Vulnerability [[28]]: ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited [[30]]: Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts [[31]]: 91 Vulnerabilities Patched in Spring Application Framework [[33]]: Personal Information Exposed in Apollo Global Data Breach [[34]]: Rethinking Application Security for the AI Era [[35]]: Iran-Linked Hackers Shut Down UK Power Plant for Four Days [[36]]: TikTok Reaches $400 Million Settlement With US Justice Department Over Children's Privacy [[39]]: Fake GTA 6 Extended Look and demo sites deliver an infostealer [[40]]: Fake Microsoft security scans trick victims into uninstalling their antivirus [[42]]: AliExpress caught using silent audio to fingerprint visitors' browsers [[43]]: ToxicPanda 2.0 can take over your Android phone and banking apps