The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X.
ShinyHunters is the extortion group that said in September it had breached the FBI’s jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public.
The suspect is a Canadian citizen who was arrested in Pennsylvania, according to The New York Times and CBS News. Both cited unnamed sources.
The Times reported that the arrest was made on suspicion of involvement in the theft of FBI data. A law enforcement source told CBS News that the suspect is believed to have been directly involved in the hack.
An FBI spokesperson declined to comment on the Times report, CBS News said. Patel’s post does not say whether the suspect took part in the breach. It calls ShinyHunters “the group believed to be responsible for the recent FBIjobs.gov incident.”
Patel also wrote that the FBI will keep working with its partners “to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.” Other suspected co-conspirators are still free, the law enforcement source told CBS News.
Earlier Arrests in the Netherlands and Jordan
Reuters counts the new arrest as the third made public since news of the breach broke in late September. The FBI said in a statement Reuters reported on October 3 that it had “already worked with partners to arrest multiple subjects.”
| Where | When | Made public by | Suspect |
|---|---|---|---|
| Netherlands | September 15 | Dutch police and the FBI | A 24-year-old Amsterdam man. Identified to Reuters and CBS News as Pepijn van der Stap. Dutch police have not named him. |
| Jordan | September 29, according to Reuters’ sources |
Reuters, citing unnamed sources. Jordanian state media also quoted an official who confirmed an arrest and gave no name, The National reported . |
Named by Reuters’ sources as Saif al-Din Khader. |
| Pennsylvania, according to The New York Times and CBS News | In the week it was announced, according to CBS News | FBI Director Kash Patel | Not named. A Canadian citizen, according to the same two outlets. |
The man arrested in the Netherlands was taken into custody a week before ShinyHunters announced the FBI breach on September 22. The Dutch police statement, published in Dutch, does not mention the FBI or its jobs portal.
The FBI said in a video statement that he is one of the group’s alleged leaders and that Dutch police made the arrest under Dutch law with FBI support. ShinyHunters told The Hacker News that he has no association with the group.
Khader, the suspect detained in Jordan, is cooperating with the FBI, according to Reuters, which cited people familiar with the matter.
The FBI has not said whether the new arrest resulted from that cooperation.
What Was Stolen and How the FBI Says It Happened
A sample of the data that ShinyHunters shared contained extensive personal information on FBI employees, details of sensitive job roles, and psychiatric and medical information, a Reuters analysis found. An internal FBI notice confirmed that hackers obtained employee information, a source told CBS News.
The FBI’s review has so far found that the breach resulted from a security failure on a platform managed by an outside organization. It happened after “a contractor failed to implement a security patch explicitly issued to secure the platform,” Brett Leatherman, assistant director of the FBI’s Cyber Division, told Reuters on October 5. The FBI has removed the contractor.
The FBI did not name the platform or the organization. Two sources told Reuters they are PeopleSoft, Oracle’s human resources software, and Accenture. Accenture told Reuters it was “proud to support the mission of the FBI” and did not answer the news agency’s questions about the contractor.
ShinyHunters said it targeted the FBI over an advisory from May that it says makes false claims about the group. The advisory describes ShinyHunters as a cybercriminal group that specializes in large-scale data breaches and extortion.
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
