FBI Director Kash Patel and Defense Secretary Pete Hegseth’s workplaces have each suffered a significant data breach.
On Friday, new details emerged about information the hacking group ShinyHunters obtained from the FBI’s servers—a breach that first came to light earlier this week.
Among the files in the alleged 2 terabytes to 3 terabytes of stolen data, Reuters reported, are the medical and psychiatric evaluations of FBI personnel. For instance, one record noted an applicant’s aspirin usage and their allergies to dust and cats. Another applicant was marked as having “symptoms of depression” in high school. Another record contained the results of an electrocardiogram, a test that measures the heart’s electrical activity.
The BBC reported Friday that one record contained a blood and urine test document, while another noted an individual’s “shellfish and banana allergy.”
The breach is likely of interest to adversaries of the U.S.
“I would be shocked if Russian intelligence isn’t knocking on their door and saying, ‘We want that stuff, hand it over,’” cybersecurity consultant and former FBI operative Eric O’Neill told Reuters.
Reached for comment, the FBI told the Daily Beast it is “aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII).”
The statement continued, “While the point of breach is still undetermined - whether a third-party or the FBI’s enterprise - we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk.”
Meanwhile, a breach of the Pentagon’s human resources system has also raised alarms.
This data breach began last October, CNN reported, but it was not discovered and fixed until July. Among the information “unauthorized users” obtained from the Defense Manpower Data Center (DMDC) were Social Security numbers and other personal information belonging to current and former personnel, according to a letter from DMDC to victims.
Service members’ “occupational specialty” was one data point accessed in some instances. According to Military Times, 4 million individuals could have had their information exposed.
The letter says the Pentagon “does not have any indications of misuse” of the data, which was not encrypted. But as with the FBI data breach, this breach could still attract interest from malevolent foreign actors or cybercriminals.
“We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system,” the letter says.
The DMDC housed at least 60 million records in the 2024 fiscal year.
“The services and access to data we provide support so many vital government entities, including the legislative branch, human services, national defense, labor, healthcare, finance, veterans affairs, research, and more,” its website says.
The Pentagon did not immediately respond to a request for comment from CNN or the Daily Beast.
