The hacking group ShinyHunters has claimed responsibility for stealing medical and psychiatric evaluation records from the FBI, according to reports reviewed by BBC News and Reuters. The stolen documents include blood and urine test results, mental health assessments, doctors' observations, allergies, medical conditions, agents' names, and addresses.
If confirmed, the breach represents a significant counterintelligence and identity risk. As Etay Maor, vice president of threat intelligence at Cato Networks, noted: passwords can be reset if stolen, but medical records cannot.
Scope and Content of the Breach
Reuters reviewed six documents from the stolen cache and found mental health assessments conducted before employment, electrocardiogram results, and notations about applicants' medical histories. The cybercriminals claim the total stolen data amounts to between two and three terabytes, with a 5,000-line sample connecting identified FBI employees to intelligence, surveillance, and counterintelligence positions, including operations in Russia and China.
ShinyHunters asserted that it also hacked internal systems including the FBI MedLink service and background-checking systems, though these claims have not been independently verified. The FBI stated it was "actively and aggressively investigating" the matter on Wednesday.
Attribution and Attack Methods
ShinyHunters is a financially motivated operation that has operated since at least 2019, according to Huntress. The group has previously stolen SaaS and cloud data while employing extortion tactics. In this incident, rather than demanding ransom, the group initially sought an apology from the FBI regarding a May notice but later rescinded that demand.
Google's Mandiant linked ShinyHunters to previous PeopleSoft hacks exploiting the CVE-2026-35273 vulnerability, which Oracle assessed with a severity score of 9.8 out of 10. The FBIJobs.gov portal uses Oracle PeopleSoft technology, though no public evidence currently connects the vulnerability to this breach.
Historical Precedent and Long-Term Risks
The breach echoes the 2015 Office of Personnel Management breach, which compromised sensitive data of approximately 22 million federal employees and contractors, according to the Government Accountability Office. The GAO later found that privacy controls were not fully installed across all systems examined by the agency responsible for federal background checks.
Eric O'Neill, a former FBI agent and founder of Nexasure AI, told Reuters that medical information in this breach elevates the incident to a comparable level and may attract hostile intelligence services.
Broader Industry Impact
Individual breaches increasingly contribute to structural cybersecurity cost pressures across industries. IBM's 2026 breach study reports the global average cost of a breach at $4.99 million, representing a 12 percent increase, while AI-driven attacks rose 56 percent. Check Point recorded a 48 percent rise in extortion victims.
The World Economic Forum found that 94 percent of respondents expect AI to be the biggest force reshaping cybersecurity. Gartner forecasts $2.7 trillion in worldwide AI spending in 2026, while the International Monetary Fund warns that shared digital infrastructure and machine-speed attacks can transform individual breaches into broader financial-stability risks.
