FBI and Pentagon Confirm Separate Data Breaches Exposed Personnel Medical Records and Social Security Numbers

FBI Director Kash Patel and Defense Secretary Pete Hegseth are each dealing with a data breach on their watch.

On Friday, new details emerged about a hack of FBI servers by a group called ShinyHunters, a breach that first came to light earlier in the week, according to Reuters. Reuters reported the stolen files total an alleged 2 to 3 terabytes of data.

The files reportedly include medical and psychiatric evaluations of FBI personnel. Reuters reported one record noted an applicant's aspirin use and allergies to dust and cats. Another flagged "symptoms of depression" the applicant had in high school. A third contained results from an electrocardiogram, a test of the heart's electrical activity.

The BBC reported Friday that additional files include a blood and urine test document and a record noting someone's "shellfish and banana allergy."

The FBI said in a statement that it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." The bureau declined to comment further to Reuters.

Personnel files as leverage

Medical files on federal law enforcement applicants are not just private. They're leverage. Eric O'Neill, a cybersecurity consultant and former FBI operative, told Reuters he'd be "shocked if Russian intelligence isn't knocking on their door" to get the stolen data, saying, "We want that stuff, hand it over."

Personnel files with psychiatric history, health conditions, and allergies are the raw material for blackmail and targeted recruitment. The FBI hasn't said whether it believes a nation-state actor is behind the ShinyHunters breach or whether that group is acting independently and could sell the data to one.

The Pentagon's breach is older and bigger in scope

Separately, the Defense Manpower Data Center, the Pentagon's human resources system, was breached starting last October, according to CNN. The intrusion wasn't discovered and fixed until July.

A letter from DMDC to victims, cited by CNN, says "unauthorized users" obtained Social Security numbers and other personal information belonging to current and former Defense Department personnel. In some cases the data included service members' "occupational specialty."

Military Times reported up to 4 million individuals could have had their information exposed. The DMDC letter states the data was not encrypted. The letter says the Pentagon "does not have any indications of misuse" of the data so far, but that's a statement about what's been detected, not a guarantee nothing has happened. The letter adds that DMDC is "taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system."

The DMDC housed at least 60 million records as of fiscal year 2024, according to its own website, which describes it as supporting "the legislative branch, human services, national defense, labor, healthcare, finance, veterans affairs, research, and more." A breach of that system is a breach of one of the government's central personnel databases.

What's unproven

Neither the FBI nor the Pentagon has confirmed the data has been sold, used, or accessed by a foreign government. Both agencies say the breaches could still attract interest from malevolent foreign actors or cybercriminals. The Pentagon did not respond to requests for comment from CNN or The Daily Beast, and the FBI did not respond to a Daily Beast request for comment either.

What's unresolved: whether the data sitting unencrypted at DMDC for months before discovery draws further scrutiny, and whether either agency will disclose if ShinyHunters or anyone else has already tried to sell the stolen files. Until then, current and former FBI and Defense personnel are left waiting to find out if their psychiatric records and Social Security numbers are already circulating.