FBI data breach is getting personal: Why ShinyHunters’ alleged hack has agents fearing stolen home addresses, family details and medical records could put families at risk

The FBI is dealing with a breach that has left current and former agents worried about something more personal than stolen files.

According to samples reviewed by BBC News, the hackers appear to have obtained names, home addresses, phone numbers, badge numbers, job titles and information about spouses. Some of the material reportedly includes medical records from fitness-for-work examinations.

For agents who investigate criminals and hostile intelligence networks, that creates a different kind of risk. Their work can already make them targets. Their private information can now potentially make it easier for someone to find them.

Why are FBI agents worried about their families?

One former FBI agent told BBC News that current agents are discussing the breach in a group chat, with particular concern for undercover personnel.

The fear is not limited to someone publishing a name online. Personal information can be used to build convincing phishing messages, impersonate officials, pressure employees or target relatives.

Michael McPherson, a former FBI agent who now works at cybersecurity company ReliaQuest, said the reported exposure could affect families who are normally separated from the risks of an agent's job.

What information do the hackers appear to have?

The samples shared with reporters appear to contain thousands of records. They reportedly include information on agents and senior FBI officials, as well as details connected to spouses. BBC News also reviewed samples of medical examinations containing blood and urine test results and doctors' notes.

Medical information can reveal deeply private details about an individual. Combined with names, addresses and telephone numbers, it can give criminals several pieces of information needed to construct targeted scams or intimidation attempts.

The FBI has said it is aggressively investigating how the breach happened.

Could the stolen information already be circulating?

Cynthia Kaiser, a former FBI deputy director of cyber who now leads the Research Centre at Halcyon, said some of the data appeared to have escaped the hackers' control and was already circulating among online cyber-research communities.

Once personal records spread across criminal forums and private groups, removing the original files does not necessarily remove the risk.

Kaiser pointed to previous FBI breaches in which stolen information continued circulating online years after the initial incident.

Why are agents angry at the FBI?

ShinyHunters is known for high-profile data theft and extortion attacks, but former FBI personnel who spoke to BBC News questioned how a group of this kind could obtain such sensitive information from an agency with enormous cybersecurity resources.

One former cyber agent described the alleged security failures as "sloppy and lazy."

The frustration is also practical. Agents now have to consider what happens if their personal details become public, while the bureau works out how much information was taken and how widely it has spread.

Staff have reportedly been advised to use DeleteMe, a service that helps remove personal information from data-broker websites. One former investigator told the BBC that response did not match the scale of the concern inside the workforce.

Why does the FBI face a wider security problem?

Former officials have raised concerns that exposed personal information could be useful to hostile intelligence services seeking to identify or approach FBI employees.

A home address, family connection or medical detail can become a small piece of a much larger intelligence picture.

There is also concern about online criminal groups using exposed information to harass agents or arrange swatting attacks. Such incidents can send armed police to an unsuspecting person's home after a false emergency report.

ShinyHunters has threatened to release more of the stolen material unless the FBI meets its demands. Unlike many ransomware groups, it is reportedly not asking for money. It wants the bureau to withdraw an advisory published in May that the group says offended it.

(This story uses reporting and information from a BBC.com online report.)