What drives ShinyHunters, the group that claimed responsibility for hacking the FBI?

What drives ShinyHunters, the group that claimed responsibility for hacking the FBI?

The notorious hacking group is linked to dozens of major data breaches

The hacking group that claimed responsibility for stealing a massive trove of data from the FBI on Tuesday — including officials' job assignments, addresses and social security numbers — has been linked to dozens of cyberattacks targeting large companies and institutions.

ShinyHunters has been active since at least 2019 and is known as one of the most prolific data theft and extortion groups, typically demanding ransom payments in exchange for not releasing the sensitive data it's obtained.

But in the case of the recent breach, which a former FBI operative called "foreign intelligence service goldmine," the group says it's not asking for money.

ShinyHunters is giving the FBI one week to remove or "correct" a report from May that makes claims about the group that it says are false.

The FBI is investigating the breach and the FBIJobs.gov portal was still down Thursday afternoon.

FBI employee data allegedly hacked by ShinyHunters contains sensitive info about intelligence roles

The hacking group caused chaos at universities around the world in May, including in Canada, with a cyberattack on Canvas, an online learning-management system that connects millions of students with their instructors.

Here's what we do know about ShinyHunters.

ShinyHunters is a loose collection of young hackers in multiple countries, according to researchers who spoke to CBC News.

Cynthia Kaiser, head of Halcyon's Ransomware Research Center and former deputy assistant director of the FBI’s cyber division, says the group is made up of teenagers or people who "act like teenagers."

"I think that ShinyHunters has historically demonstrated what would be seen as an immaturity with their communications — taunting of victims, doxxing of security researchers — actions that are really atypical of normal ransomware operations that run a lot more like businesses," she said.

Australia says OpenAI agent hacked government health data website

Kaiser says this is highlighted by the group attacking the FBI the same week it attacked rival "ransomware gang" Cl0P, and speculates that this week's attacks could cause the group's downfall.

"When you're targeting law enforcement, you're essentially kicking a bee's nest and hoping nothing comes back out at you."

Sebastien Raoult, a French citizen who the U.S. Department of Justice says was a member of ShinyHunters, was arrested in Morocco in 2022 and extradited to the U.S. where he was sentenced in 2024 to three years in prison and ordered to pay more than $5 million US in restitution for wire fraud and aggravated identity theft. He was 22 years old at the time of his sentencing.

A cyberattack hit universities worldwide, including top Canadian schools. Here's what we know

Telus probes cybersecurity incident that 'ShinyHunters' group claims responsibility for

Experts tell CBC News it's notable that members seem to be proficient English speakers, separating them from other ransomware groups that tend to be Russian.

Kaiser says ShinyHunters members overlap with other groups like Scattered Spider and LAPSUS$ — the three also claimed to work together last year in what cybersecurity analysts dubbed a "cybercrime superpgroup" — and the broader network includes members in the U.S., U.K. and Canada.

Ian Lin, an ethical hacker and head of research and development at Toronto-based cybersecurity company Packetlabs, says it would be unwise for any organization to dismiss the threat that ShinyHunters poses, regardless of the way the group communicates publicly.

"They've shown incredible capability," Lin said.

"We have to take them very seriously."

Lin, who hacks organizations to expose vulnerabilities and help them tighten their digital security, says ShinyHunters are chasing notoriety and fame, despite individual members being anonymous.

"Every time they compromise something, they really want a big bang," he said.

Primarily, though, he says the group seems to be mostly financially motivated and not driven by a particular ideology or worldview.

"When there's leaders that can rally a group of people who grew up with AI, who grew with technology, and they're disillusioned by the system, the society, it's very easy for them to fall into these types of groups," he said.

More than $100M worth of bitcoin stolen in data breach | Hanomansing Tonight

"They have to live somehow. So a lot of their breaches, there's a big financial motivation."

The FBI hack was unusual in the sense that it was not financially motivated, but a retaliation for several claims made by the law enforcement agency — including that ShinyHunters is known to threaten family members of its targets and threaten to release embarrassing or compromising images of its victims.

ShinyHunters denied ever using those tactics, in a public statement directed at the FBI.

Chinese hackers disrupted U.S. Justice Department, NASA, Federal Reserve, U.S. says

Canadian investigation launched into data breach that exposed millions of IDs

"This was to prove that they were right — that you have to listen to us," Lin said.

ShinyHunters have been associated with high-profile cyberattacks affecting companies including Telus, Microsoft, Ticketmaster, Pornhub and Rockstar Games.

Last year, according to U.K. media reports, ShinyHunters members claimed responsibility for the theft of more than two million records from the country's Legal Aid Agency and threatened to publish the information unless one of its members was freed. The hack wreaked havoc on the legal system but the group did not follow through on its alleged threat after the deadline passed.

Kaiser also says she has not tracked any specific ideological motive behind the group's actions, but says they have a penchant for picking "incredibly large" targets and wanting to show off what they can do.

"It's almost a more of a personal aggrandizing and being able to have those bragging rights," she said. "That seems to motivate just as much as the money."

Kevin Maimann is a senior writer for CBC News based in Edmonton. He has covered a wide range of topics for publications including VICE, the Toronto Star, Xtra Magazine and the Edmonton Journal. You can reach Kevin by email at kevin.maimann@cbc.ca.