The chart was in the sample

The earlier note stopped at names, homes, and phones. The files shown to reporters this week are a different category.

Reuters, published today, says it reviewed about half a dozen documents from the set ShinyHunters has been circulating. One was a fitness-for-duty exam that recorded a daily aspirin and an allergy. Another said an applicant had shown symptoms of depression in high school. A third carried an electrocardiogram. The BBC had already reported a blood and urine test in the sample. Reuters matched two Social Security numbers to credit-bureau data, lined a pre-employment mental-health evaluation up with a former analyst’s LinkedIn dates, and matched the name of a psychiatrist on a form to a profile with the same title. A person familiar with the matter confirmed that a listed medical professional was doing FBI evaluations at the time, and could not authenticate the whole file.

Reuters is explicit about the limit. It could not tell whether those pages represent the rest of the pile, or whether there is a rest of the pile. The FBI declined to comment on the records. On Wednesday it said it was aggressively investigating the reported breach.

What the hackers added, and what still is not checked

They told Reuters the holding includes discharges, prescriptions, clinical visits, and “any health issues with Agents,” and that they reached MedLink, applicant screening, and a background-investigation contract unit. Reuters could not corroborate those system names. Two to three terabytes remains their number.

A checked ECG is a fact about a document. It is not a fact about every agent. The May advisory they hate is the one that said this group exaggerates access. That sentence does not make the pages Reuters held fake. It makes the unread archive still unread.

If a household is in that half-dozen, or might be

Do not argue the terabyte. Ask whether a medical form with your name has been shown to a reporter, and treat a call that already knows a diagnosis, a prescription, or a psych eval as the incident. A home address was already enough to find the door. A chart is enough to choose the sentence.

I still do not treat “almost all” as a row count. I do treat a mental-health form that survived a credit-bureau check as a file that left.