The hacking collective responsible for a significant data breach at the FBI has stated it will refrain from releasing the acquired information, yet it cannot assure what will occur with the data already disseminated.
ShinyHunters took credit for the theft of an extensive amount of data from the FBI last Tuesday, which included officials’ job titles, addresses, and social security numbers, and has given the agency a week to retract an unfavorable statement about them.
As the deadline nears, a representative from ShinyHunters provided a statement to CBC News on Monday, asserting that they never intended to disclose the sensitive information and that the media and the public have made “numerous incorrect assumptions and wild speculations.”
This group has been associated with numerous cyberattacks aimed at major corporations and institutions. While ShinyHunters typically demands ransom for not releasing confidential information, they have made it clear that this was not their objective in this instance.
Campaign to ‘combat disinformation’
ShinyHunters refuted claims of soliciting a ransom from the FBI but admitted that “previous operations” might lead to misunderstandings.
“We have repeatedly asserted that this is not extortion because right from the start, we decided that we would never publish this data. We have never had any intention to do so,” the statement included.
The group informed CBC News that their actions against the FBI were part of a broader effort to “combat disinformation” regarding their methods.
“Had we made this statement under normal circumstances, our words and intentions would not have received such widespread attention. We would likely have been ignored. Now, however, everyone is aware of the issue and our actions.”
ShinyHunters took exception to an FBI report from May that alleged, among other things, that the group is known to threaten the family members of its targets and to threaten the release of embarrassing or compromising images of their victims.
ShinyHunters denied ever employing such tactics and issued a statement following last Tuesday’s data breach, demanding that the FBI remove or “correct” the report.
The group shared a 5,000-line spreadsheet containing breached FBI data with certain journalists, claiming it represented only a fraction of their alleged two to three terabytes of data.
This sample included names, addresses, phone numbers, dates of birth, social security numbers, and emergency contact information for what they claimed were thousands of FBI personnel.
When CBC News inquired on Monday whether ShinyHunters had implemented measures to prevent the leaked data from being disseminated by other parties, the representative stated they “cannot guarantee” the safety of those samples, attributing the risk to their loss of control and alleging that some journalists had betrayed their trust.
Canvas, a program used by postsecondary schools across Canada, has been hit by hackers. A group called ShinyHunters is claiming responsibility — and asking for a ransom. Emsisoft threat intelligence analyst Luke Connolly lays out what we know.
‘Can’t trust them,’ researcher says
Ian Lin, an ethical hacker and head of research and development at the Toronto cybersecurity firm Packetlabs, expressed concern regarding the situation.
He noted that he has come across “several researchers” online claiming to have access to the data, in addition to journalists.
“There will be individuals willing to pay a significant amount for this data,” Lin informed CBC News.
The breach, described by a former FBI operative as a “foreign intelligence service goldmine,” has raised alarms about the safety of the agency’s staff.
The New York Times reported Monday that the FBI circulated a memo to its employees acknowledging the theft of personal information during the cyber incident, urging them to stay alert at home and work, and to report any unsolicited contacts or threats.
Lin expressed skepticism that ShinyHunters would uphold their promise, noting that it is common for criminal hacking groups to go back on their commitments or utilize the same data as leverage multiple times.
“I believe their motivation behind this was to gain attention. However, you still cannot rely on them to safeguard your data. This now serves as leverage over law enforcement and the FBI, and they could exploit this information for their own purposes at any time,” he stated.
“The FBI and law enforcement must remain vigilant. Significant lessons should be learned from this incident.”