FBI arrests another suspected ShinyHunters member over FBIJobs.gov breach

The FBI has arrested another suspected member of the ShinyHunters data extortion group, Director Kash Patel announced on Friday, October 9, as the bureau pursues those it holds responsible for the breach of its FBIJobs.gov platform. According to BleepingComputer and The Record, Patel described it as the latest arrest "in a matter of days" involving the network, signaling an accelerating law enforcement campaign against one of the most active extortion crews of recent years.

What happened

Patel announced the arrest on X but did not name the suspect or say where it took place. Both outlets cite The New York Times as reporting that the suspect is a Canadian national arrested in Pennsylvania and is considered a primary co-conspirator in the intrusion. The Record says the operation took place earlier in the week and that the FBI did not respond to requests for further details. Authorities have not disclosed any charges.

Patel said the FBI would continue to work closely with partners to disrupt the group and its associates, according to BleepingComputer.

The FBIJobs.gov breach

ShinyHunters is believed to be responsible for the breach of FBIJobs.gov, which ran on a platform operated by a third-party vendor. The group told BleepingComputer in September that it exploited an alleged Oracle PeopleSoft zero-day and then moved laterally into FBI-managed AWS GovCloud infrastructure, claiming to have stolen 2TB to 3TB of data. These claims have not been independently verified in full, but BleepingComputer says data samples confirmed exposure of employee information such as home addresses and Social Security numbers.

The Record reports that the stolen data covers nearly every FBI employee and includes medical records, phone numbers and work areas, along with thousands of records on local police officers who serve on FBI task forces. The FBI has attributed the breach to an Accenture contractor who failed to patch a vulnerable system; Reuters reported the contractor was fired this week, according to The Record.

Previous arrests

The new arrest follows several others. Dutch police arrested 24-year-old Pepijn van der Stap in Amsterdam on September 15, although ShinyHunters denied he was associated with it, BleepingComputer reports. A suspected member known as "Rey", identified by Reuters as Saif al-Din Khader, was detained in Jordan and is reportedly cooperating with investigators. The Record adds that at least two other suspected members have been detained over the past two weeks.

Signs of disruption

BleepingComputer says the group's main representative, who had regularly communicated with the publication, stopped responding on Telegram and the account now appears deleted, while the group's data leak site went offline. A new ShinyHunters leak site later appeared, suggesting some members remain active. The Record reports that the group said it would not release the stolen FBI data and acknowledged that several of its members had reportedly been arrested.

As BleepingComputer notes, earlier arrests tied to the ShinyHunters name, including cases linked to Snowflake and PowerSchool, did not stop operations under the brand, so organizations should continue to defend against its known tactics such as voice phishing against SSO accounts and abuse of third-party SaaS integrations.