FBI warning that hackers are sending fraudulent police data requests to big tech companies

WASHINGTON, D.C. - The Federal Bureau of Investigation (FBI) has issued a warning that hackers are obtaining private user information, including emails and phone numbers from U.S.-based tech companies by compromising government and police email addresses to submit "emergency" data requests.

According to Techcrunch, the public notice is a rare admission from the federal government about the threat from fraudulent emergency data requests. Emergency data requests follow a legal process designed to help police and federal authorities obtain information from companies to respond to immediate threats affecting someone's life or property.

The abuse of such emergency data requests by hackers is not something new, but the FBI is sounding the alarm because it saw an "uptick" around August in criminal posts onlne advertising access to or conducting fraudulent emergency data requests. They made the announcement public for awareness purposes. 

The FBI advisory reads, in part, "Cyber-criminals are likely gaining access to compromised U.S. and foreign government email addresses and using them to conduct fraudulent emergency data requests to U.S.-based companies, exposing the personal information of customers to further use for criminal purposes."

As noted by Techcrunch, police and law enforcement in the U.S. generally need some type of legal justification to seek and obtain access to private data that companies store on their servers. Typically, a person's private content, like their files, emails, or messages, police need to provide enough evidence of a possible crime before a U.S. court will issue a search warrant allowing the police to request that information from a private company.

The article noted, "Police can issue subpoenas, which don't require going to court, requesting companies to access limited amounts of information about a user, such as their basic account information like their username, account logins, email addresses, and phone numbers, and sometimes their approximate location."

There are also emergency requests, a procedure in which law enforcement can urgently seek a person's information from a company in the event of an immediate risk, where there is no time to seek a court order. Federal authorities said that it is those types of emergency requests that some cybercriminals are abusing.

In its advisory, the FBI said that it had seen several public posts made by known cybercriminals over 2023 and 2024, claiming access to email addresses used by U.S. law enforcement and some foreign governments. The access was ultimately used to send fraudulent and other legal demands to U.S. companies seeking private user data stored on their systems.

The advisory said that the cybercriminals were successful in "masquerading" as law enforcement by using compromised police accounts to send emails to companies requesting user data. According to the advisory, in some cases, the requests cited false threats like claims of human trafficking and, in one case, that an individual would "suffer greatly or die" unless the company in question returns the requested information.

Cybercriminals often use the requested data for harassment, doxing, and targeting individuals with financial schemes. A report from 2022 found that at the time, hackers had obtained user information from customers of Apple, Facebook, and Instagram-owner Meta, by filing fraudulent emergency data requests. 

Apple, Google, Meta, and Snap, which store huge amounts of customers' personal and private data, collectively receive tens of thousands of emergency data requests every year. In its advisory, the FBI said that law enforcement organizations should take steps to improve their cybersecurity posture to prevent intrusions, including stronger passwords and multi-factor authentication.