Hackers are demanding a retraction from the FBI.

A group calling itself ShinyHunters claims to have hacked into systems linked to the FBI and to be in possession of data on a large proportion of the US agency’s staff, including information on their family members. On 22 September, they also defaced a page on the FBI’s recruitment website, replacing it with a message claiming responsibility. The Bureau has confirmed that it is aware of the claim and is investigating, without confirming either the extent of the data or the method used to access it. Those who have examined the sample of data released by the group report that at least part of it appears to be genuine, whilst its origin remains to be ascertained.

There is at least one aspect that sets this story apart from the usual claims made by groups of this kind. ShinyHunters states that the objective is not financial, as is typically the case with ransomware. Instead, the group is calling on the FBI to retract part of a public notice issued last May, in which the agency described their tactics, referring to harassment of victims and their families and incidents of ‘swatting’ – the practice of reporting false emergencies to prompt an armed police response at someone’s home. ShinyHunters denies these allegations and wants the FBI to correct them.

It is a reversal worth noting. Normally, it is an institution that publicly defines who a criminal is and the methods they use, whereas here it is the criminal who is demanding a right of reply, almost as a company might do when targeted by an article it considers inaccurate, complete with a deadline for a correction. This detail is not insignificant: it reveals a group that cares as much, if not more, about its reputation than about the loot, and that uses the breach as leverage to rewrite the public narrative about itself, rather than for a ransom.

Regarding the method used in this specific incident, ShinyHunters refers to a cyber vulnerability in an Oracle system linked to the FBI’s recruitment portal, but there is as yet no independent confirmation of this. The group’s track record, however, provides a useful context for understanding the phenomenon. The breaches already attributed to them – from the Salesforce case to that of Charter Communications – all began with a phone call: a fake IT technician convincing an employee to approve an app or confirm a set of credentials.

Whilst public attention regarding AI remains focused on systems that escape the control of their creators, news reports from recent months highlight a more mundane risk that is already proving highly lucrative for cybercriminals. No sophisticated exploit or artificial intelligence is needed to convince a human: all it takes is a voice asking for trust at the right moment. And now, it seems, the very same groups exploiting this loophole are beginning to demand control over how their activities are reported.