A 2005 FBI Hack Exposed a Secret List of Informants and Hunted Cybercriminals

In 2005, an email server of the FBI's was catastrophically hacked, and journalists quoted sources who were worried that sensitive information had been obtained. At the time, the agency downplayed its seriousness, castigating the reporters in a press release for not providing an informed or accurate portrayal of the attack.

It turns out secrets were exposed, and pretty serious ones at that. According to a new longform piece from WIRED's Kevin Poulsen, a hacker got hold of a list of cybercriminals the US government was trying to hunt down.

The list, marked "Law Enforcement Sensitive" and "Do not transmit over the Internet," contained the aliases of over 100 hackers, and in some cases, Poulsen writes, their real names. On top of this, some of the hackers were labeled as "top-level target," or "currently cooperating with the government." The White House was reportedly informed of the incident.

The hack targeted an AT&T data center in New Jersey which ran servers for the US government, including one that had handled email for every agent with an FBI.gov address, Poulsen writes.

"The compromise affected only those fbi.gov Internet e-mail accounts hosted by a particular commercial service provider. All FBI Internet e-mail accounts have been migrated, or are in the process of being migrated, to a more secure e-mail capability," the FBI wrote in a February 2005 press release.

According to Poulsen's story, the hacker responsible was Maksym Igor Popov, a Ukrainian with a long, twisted history working for, and betraying, the FBI.

Naturally, this isn't the first time a US government agency has played down the seriousness of a data breach. Earlier this year, a hacker dumped the contact details of 20,000 FBI and 9,000 DHS employees. The DHS said that "there is no indication at this time that there is any breach of sensitive or personally identifiable information." But days later, it emerged the hacker had obtained forensics reports, as well as State Department emails.