FBI Tells Employees to Assume Hackers Stole Their Personal Data: What Federal Employees Should Do Now
An internal FBI data breach memo sent Friday told employees the bureau is operating on the premise that hackers are taking personal information on every FBI employee. The memo stated: "We are operating under the premise that the threat actor is also exfiltrating PII of all FBI employees." It even advised staff to set up voicemail greetings using AI-generated voices.
For FBI employees and their families, and for every federal employee who remembers past government data breaches, this is a serious development that deserves a calm, practical response.
How FBI Employees Found Out
Many FBI employees learned about the hack from the news last week. The FBI says it messaged employees within 24 hours. The day after the news broke, staff received an email reminding them that October is Cybersecurity Awareness Month. Friday's memo followed.
What the Hackers Claim to Have
The New York Times reviewed a sample of the data that the hackers shared. According to that reporting, the sample included:
- Home addresses and Social Security numbers.
- Spouses and emergency contacts, sometimes including parents, siblings, and even children.
- Information about who works counterintelligence and the Russia, China, and Iran desks.
This spring, the FBI publicly warned that this same group, known as ShinyHunters, harasses victims and their families. Now that group says it holds information on FBI families.
Why This Isn't Over
The hackers now say they never meant to publish the data. But researchers warn that the information could still be sold to other criminals or to foreign governments. A promise not to publish does not undo the exposure.
If you work for the FBI, or your family member does, you are not being paranoid. Your own agency wrote that memo.
Steps to Take Now
If you are a current or former FBI employee:
- Freeze your credit at all three credit bureaus. It is free.
- Report any unsolicited contact or threat.
- Document every dollar and every hour this breach costs you.
- Do not identify yourself online, including in social media comments about the breach.
A Broader Question for Every Federal Employee
Many federal employees still remember the OPM data breach and how they learned about it. Today, OPM is moving toward consolidating health claims data on federal employees and many of their family members, an effort we covered in our post on OPM's health claims data warehouse. The FBI breach is a reminder to ask how well agencies protect the information they already hold before collecting more.
Talk to Someone Who Knows Federal Employment Law
If a data breach or an agency's handling of your personal information is affecting your job or your family, the federal employee lawyers at Southworth PC can help you understand your options.
Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation.