In emails sent Monday to Nextgov/FCW and CBC News, the group said it made the decision from the outset never to release the data. “Since the very beginning we had made our decision that we would never publish this data. We have never intended to nor have we ever planned to,” the group wrote.
“Marketing campaign,” not extortion
The group had given the bureau a one-week deadline to retract a May 15 advisory warning that hackers associated with it use harassment and threats to pressure victims into paying.
In Monday’s statements it said the public misread that demand: “This was all a marketing campaign to protect our business and actively combat disinformation,” the group told Nextgov/FCW, adding that it never expected the FBI to comply.
Experts warn the danger is not over
Security experts caution that a promise not to publicly release stolen data does not eliminate the risk. ShinyHunters previously circulated a sample of roughly 5,000 records to news organizations; Reuters partially verified some entries against credit-bureau records, and the BBC reportedly saw fitness-for-work medical records among the samples.
The group’s latest statements do not say it has deleted the records.
“There’s going to be people that are willing to pay a high price for this data,” security researcher Ian Lin of the cybersecurity firm Packetlabs told CBC News — even if the group says it will not leak it.
An internal FBI memo reported by Reuters said the bureau was proceeding on the assumption that personally identifiable information belonging to all of its employees had been taken. Employees have been advised to report unsolicited contacts, avoid calls from unknown numbers, and take extra precautions to protect themselves and their families.
How the breach unfolded
The incident began around September 21–22, when the FBI’s recruitment portal FBIJobs.gov was defaced with a message reading “This site has been seized by ShinyHunters.”
The group later claimed on its dark-web site to hold 2–3 terabytes of data from FBI systems including Criminal Justice, HR and Medlink, attributing the intrusion to an Oracle PeopleSoft zero-day — a claim neither Oracle nor the FBI has confirmed.
The FBI has said only that it is investigating claims of a compromise of the FBIJobs.gov portal and alleged exposure of employee personally identifiable information, and that it is working with third-party providers to mitigate risk. The jobs website remained offline for maintenance through the week.
Whether the group actually holds data on every agent and applicant, as it claims, remains unverified — a 5,000-record sample, however authentic-looking, does not establish the full scope of a claimed 2–3 terabyte haul.
What is now clear is that the most visible standoff between a hacking collective and US federal law enforcement in years ended not with a leak, but with a press statement.
By Hamza Faisal
