Hacker claims breach of FBI's critical-infrastructure forum
A hacker claims to have posed as the CEO of a financial institution to gain access to the more than 80,000-member database of InfraGard
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.A hacker who reportedly posed as the CEO of a financial institution claims to have obtained access to the more than 80,000-member database of InfraGard, an FBI-run outreach program that shares sensitive information on national security and cybersecurity threats with public officials and private sector individuals who run U.S. critical infrastructure. The hacker posted samples they said were from the database to an online forum popular with cybercriminals last weekend and said they were asking $50,000 for the entire database.
The hacker obtained access to InfraGard by posing as the CEO of a financial institution, they told independent cybersecurity journalist Brian Krebs, who broke the story. They called the vetting process surprisingly lax.
The FBI did not immediately respond to a request for comment from The Associated Press. Krebs reported that the agency told him at was aware of a potential false account and was looking into the matter.
InfraGard's members include business leaders, IT professionals, military, state and local law enforcement and government officials involved in overseeing the safety of everything from the electrical grid and transportation, to health care, pipelines, nuclear reactors, the defense industry, dams and water plants and financial services. Founded in 1996, it is the FBI's largest public-private partnership, with local alliances affiliated with all its field offices. It regularly shares threat advisories from the FBI and the Department of Homeland Security and serves as a behind-closed-doors social media site for select insiders.
The database has the names, affiliations and contact information for tens of thousands of InfraGard users. Krebs first reported its theft on Tuesday.
The hacker, going by the username USDoD on the BreachForums site, said on the site that records of only 47,000 of the forum’s members’ — slightly more than half — include unique emails. The hacker also posted that the data contained neither Social Security numbers nor dates of birth. Although fields existed in the database for that information, InfraGard's security-conscious users had left them blank.
However, the hacker told Krebs that they had been messaging InfraGard members, posing as the financial institution's CEO, to try to obtain more personal data that could be criminally weaponized.
The AP reached the hacker on the BreachForums site via private message. They would not say whether they had found a buyer for the stolen records or answer other questions. But they did say that Krebs' article "was 100% accurate.”
The FBI did not immediately respond to an email seeking comment on how the hacker was able to trick it into approving the InfraGard membership. Krebs reported that the hacker had included a contact email address that they controlled — as well as the CEO's real mobile phone number — when applying for InfraGard membership in November.
Krebs quoted the hacker as saying InfraGard approved the application in early December and that they were able to use the email to receive a one-time authentication code.
Once inside, the hacker said, the database information was easy to obtain with simple software script.