'We hacked the FBI:' Hackers say they have data on all FBI employees

Original Article ↗ Hacker News Discussion ↗

Hackers from the ShinyHunters group claim to have breached an Oracle PeopleSoft system used by the FBI, exfiltrating 2–3 TB of data including detailed records on employees and their spouses, and potentially far more sensitive case information. Commenters highlight the national security implications—especially for undercover agents and ongoing investigations—while criticizing long-standing government reliance on insecure legacy enterprise software and weak operational security. The exchange broadens into a wider argument that large, networked databases are increasingly impossible to protect, with many calling for stricter liability, less data collection, and more robust, defense-in-depth approaches rather than compliance theater.

Breach Overview and Claims

  • Thread centers on ShinyHunters’ claim they hacked an FBI Oracle PeopleSoft HR instance, pivoted into AWS GovCloud, and exfiltrated 2–3 TB of data.
  • Sample released allegedly includes FBI employees’ names, addresses, phone numbers, and spouse details.
  • Some see this as a major national‑security incident; others argue similar information could be largely reconstructed from prior breaches, data brokers, and social media.

Attack Vector: Oracle PeopleSoft / GovCloud

  • Multiple comments say this was reportedly a PeopleSoft 0‑day, consistent with past high‑profile breaches (e.g., universities, resorts) involving Oracle HR/ERP.
  • Strong criticism that Oracle’s enterprise stack is treated as “non‑security‑critical” despite housing highly sensitive data.
  • Extra concern that this application had a path into GovCloud; commenters say robust DLP, logging, and anomaly monitoring should have caught multi‑TB exfiltration.

Data Scope and National Security Concerns

  • Worries about exposure of undercover agents, open investigations, and detailed personnel dossiers (similar to the 2015 OPM breach).
  • Some speculate “all FBI data” could include case files and broader investigative material, not just HR records; others call this unclear and possibly exaggerated.

Feasibility and Skepticism About Exfiltration

  • Skeptics doubt that several TB could be pulled out “quietly”; others outline plausible methods: compression, slow trickle over weeks, hiding in noisy traffic, or via non‑Internet paths.
  • Consensus that post‑mortem logs and billing (e.g., AWS) will likely show clear anomalies in hindsight.

FBI / Government IT Competence and Hiring

  • Many comments tie the breach to underinvestment in cybersecurity, low government pay vs. private sector, and recent political purges of experienced staff.
  • Debate over whether agencies have adequate incident‑response plans for “assume attacker is still inside the network” scenarios; some assume they do, others are pessimistic.

Enterprise Software, Oracle, and Build‑vs‑Buy

  • Long sub‑thread on whether government should keep using large COTS systems like PeopleSoft vs. bespoke systems.
  • Arguments:
    • Pro‑COTS: federal HR/payroll rules are extremely complex; prior bespoke efforts (e.g., another country’s Phoenix Pay) have failed badly.
    • Pro‑bespoke: big‑vendor “customization” is effectively expensive bespoke anyway; government can and has built its own large HR systems.
  • Oracle is portrayed as having a deeply negative reputation, yet still winning huge public contracts.

Security Culture, Inevitability, and Regulation

  • Many express near‑fatalism: assume any Internet‑connected system (and large PII database) will eventually be compromised.
  • Others push back, saying strong security is possible but not prioritized; complexity, “move fast” culture, and lack of incentives dominate.
  • Discussion of:
    • Treating PII like radioactive material; minimizing collection and retention.
    • Stronger regulation with real penalties or executive liability for negligent breaches.
    • Focus on resilience, blast‑radius limits, and fast recovery rather than “perfect” defense.

Red‑Teaming, Honeypots, and Bounties

  • Suggestions:
    • Government honeypots with fake data to mislead attackers.
    • Legal frameworks for unsolicited penetration testing and mandatory security bounties, so “good guys” find bugs first.
  • Others warn this could create bounty‑troll economies targeting small sites.

AI, LLMs, and “Rogue Agents”

  • Some speculate attackers may have used commercial or open‑weight LLMs as tooling; others say that on its own explains nothing.
  • Broader AI thread: concern about marketing narratives of “rogue agents,” versus more mundane reality of misconfigured sandboxes and human error.
  • Skepticism that “AI panic” is being used as cover or hype; counter‑arguments stress that agentic misuse risks are real and independently audited in other incidents.

Broader Context and Public Trust

  • Comparisons to prior large U.S. government breaches (OPM, health‑care and medical systems, contractors).
  • Several argue no large custodian can truly “keep databases safe” at current complexity, and that society is drifting toward a world where detailed dossiers on most people are available to major state or criminal actors.
  • Some see outfits like 404 Media as filling a gap left by mainstream outlets in surfacing and documenting these systemic failures.