The data stolen from the FBI in a recent hack went beyond contact information for more than 60,000 agents and officials — it also included private details from blood and urine tests, the BBC reported on Friday.

The black-hat hacker group ShinyHunters obtained "fitness-for-work" medical examinations, covering the files of an agent, a prospective agent, and senior officials including deputy directors. The records contain doctors' notes and specific medical conditions, such as a "shellfish and banana allergy" and "high cholesterol." Information about an agent's spouse was also included. The group has shared samples of the stolen data alongside its extortion demands.

According to the report, the exposure could leave agents vulnerable to scams, blackmail and targeted attacks, and could make law enforcement officers easier to impersonate.

"The list maps thousands of agents against their medical and fitness records," Etay Maor, vice president of threat intelligence at Cato Networks, told the BBC. "Passwords can be reset if stolen, but medical records cannot, so once this data is out, it stays compromised for good. That permanence, applied across an entire workforce, is what makes this leak so serious."

"Such data could be used for highly convincing phishing, impersonation, identity fraud, blackmail or even operations targeting law-enforcement personnel, making the potential implications particularly serious," said Jamie Akhtar, co-founder of CyberSmart.

The FBI has so far acknowledged only the breach itself. It has not detailed how it happened, but says it is "aggressively investigating" the incident.

Unusually, the hackers are not demanding money, the BBC noted. Instead, they are seeking a retraction of an FBI advisory published in May, which they claim "offended" them. Extortion campaigns typically center on payment, which makes a demand tied to the withdrawal of an official government advisory a notable break from the standard financially motivated playbook.

Reuters reported that some of the hacked data included information on agents involved in investigations concerning Russia, China and drug cartels. 404 Media reported that the data may also have exposed a little-known FBI hacking unit with a secretive team.

The hackers told reporters they would publish the information within five days if their demands were not met. The records appear to relate to thousands of agents, including senior officials such as deputy directors. That five-day window sets a concrete clock for what to watch next: whether the FBI discloses more about how its systems were accessed, whether the claimed PeopleSoft flaw is verified, and whether the group carries out its threat to publish.

Professor Ciaran Martin, the former head of the UK's National Cyber Security Centre, has described the hack — if confirmed — as "as serious as it gets when it comes to data breaches."

According to the hackers, they found a vulnerability in an Oracle PeopleSoft cloud storage system used by the FBI — a claim the bureau has not verified. PeopleSoft is an enterprise software platform Oracle acquired in 2005 that large organizations, including government agencies, widely use to manage HR and employee records, so any confirmed flaw in it would draw scrutiny from the many institutions that run it. Oracle is the company co-founded and currently led by Larry Ellison, a top supporter of President Donald Trump.

The BBC said the attackers were able to gain access to multiple platforms, including FBIJobs; FBI BEAST, which handles background checks on employees and applicants; FBI MedLink, which stores medical records; and FBI BICS, which contains investigative information. Taken together, the systems span recruitment, vetting, health and investigative data within a single set of compromised platforms.