Thousands of FBI special agents may have had their extremely sensitive medical data stolen in a sophisticated cyber-attack, with the criminal group ShinyHunters claiming responsibility.

The breach, which the FBI is actively investigating, reportedly includes fitness-for-work medical examination results, such as blood and urine test outcomes, and doctors' notes detailing conditions ranging from shellfish allergies to high cholesterol.

BBC News has reviewed samples of the compromised data, which appear to contain agents' full names, addresses, phone numbers, badge numbers, job titles, and information about spouses. Medical details such as "blood in the urine" and "high cholesterol" were reportedly found within the records. Experts warn that such information could be exploited for scams, blackmail, and targeted attacks, potentially putting law enforcement officers at risk and aiding criminals in impersonating officials.

Etay Maor, vice-president of threat intelligence at Cato Networks, highlighted the unique severity of this data leak, stating that unlike passwords, medical records cannot be changed, making the compromised information permanently vulnerable. The permanence of this data across an entire workforce elevates the seriousness of the breach.

The FBI has acknowledged the breach and confirmed an ongoing investigation into its cause and extent. ShinyHunters, an international hacking collective, asserted that it breached FBI systems on Monday and subsequently posted details on its darknet site. The group also shared data samples with journalists, accompanied by an unusual demand: not for money, but for a retraction of an FBI advisory issued in May, which they claim offended them.

Initial reports suggested the breach affected up to 38,000 current employees. However, the hackers have since claimed the scale is much larger, alleging they hold sensitive information on approximately 60,000 current and former FBI staff. Some of the exposed data reportedly includes details on agents involved in investigations concerning Russia, China, and drug cartels. There are also suggestions that information pertaining to a little-known FBI hacking unit may have been compromised.

Professor Ciaran Martin, former head of the UK's National Cyber Security Centre, described the incident as potentially "as serious as it gets" for data breaches, if confirmed. Jamie Akhtar, CEO of CyberSmart, cautioned that while the hackers' claims should be viewed with scrutiny, the apparent breach is deeply concerning. He elaborated that the stolen data could facilitate highly convincing phishing attacks, impersonation, identity fraud, blackmail, and operations specifically targeting law enforcement personnel.

The hackers have stated their intention to release the full dataset in five days unless the FBI complies with their demand for the advisory retraction. The FBI has not yet issued further comment beyond its initial acknowledgment of the breach and the ongoing investigation.