Sensitive information widely exposed after hackers exploit third-party vendor vulnerability
Medical data including mental health evaluations and prescriptions leaked; FBI cites "failure to apply security patches" as the cause

WASHINGTON — In a major security failure, the U.S. Federal Bureau of Investigation (FBI) has fallen victim to a massive cyberattack, resulting in the leakage of sensitive internal data, including agent home addresses, counterintelligence operations, and psychiatric medical records.

According to Reuters on the 6th (local time), the breach occurred when a third-party vendor platform utilized by the FBI was compromised, allowing employee personal information and internal operational data to slip out. The compromised files reportedly contain home addresses and specific counterintelligence details of agents handling HUMINT (human intelligence) operations.

Most notably, employee medical records fell into the hands of the hackers. An independent review of partial leaked materials by Reuters confirmed the presence of sensitive health records, including mental health evaluations, fitness-for-duty assessments, prescription histories, and electrocardiogram (ECG) exams. This exposure compromises not only the identities of intelligence personnel but also their confidential health statuses.

Investigations revealed that the breach did not target the FBI's core internally managed networks, but rather a platform administered by an external contractor. Brett Leatherman, the FBI's cyber division chief, explained that the security incident stemmed from a failure to apply necessary security patches to the affected system. The FBI has since initiated countermeasures in cooperation with the vendor.

The hackers behind the attack claim to have secured a massive trove of data concerning a vast majority of FBI employees. However, the full extent of the leakage and the complete authenticity of all claimed materials have yet to be verified. While Reuters confirmed the validity of a portion of the obtained data, it noted that the hackers' broader claims could not be independently verified.

With the confirmation that the identities and medical records of agents at America's premier law enforcement and counterintelligence agency have been leaked, intense scrutiny and controversy are expected to grow regarding information security management systems reliant on third-party contractors.

[ⓒ Global Economic Times. 무단전재-재배포 금지]