Third ShinyHunters Suspect Arrested as FBI Slowly Dismantles Group That Hacked Its Own Jobs Portal
FBI Director Kash Patel announced on X last week that agents had arrested another suspected member of ShinyHunters, the extortion outfit that claimed in September to have breached the FBI's own recruitment portal and walked off with sensitive data on nearly every FBI agent and job applicant in the system. The irony of the FBI being hacked through its hiring platform has not worn off.
The suspect, reportedly a Canadian national, was picked up in Pennsylvania. The FBI hasn't named them and no charges have been made public. Both the New York Times and CBS News cited unnamed law enforcement sources in their reporting, with CBS stating that the individual is believed to have been directly involved in the actual hack rather than playing a peripheral role.
Patel's post was careful not to explicitly connect the arrest to the breach, but did describe ShinyHunters as "the group believed to be responsible for the recent FBIjobs.gov incident" and promised continued efforts to dismantle whatever remains of the operation. CBS News reports that other suspected members are still at large.
This makes three arrests now made public since the breach surfaced in late September. The first came on September 15, when Dutch police, working alongside the FBI, detained a 24-year-old man in Amsterdam identified to Reuters and CBS News as Pepijn van der Stap, though Dutch authorities have not confirmed his name. Notably, that arrest happened a full week before ShinyHunters publicly announced the FBI hack on September 22. The Dutch police statement doesn't mention the FBI's portal at all. The FBI has described van der Stap as one of the group's alleged leaders, which ShinyHunters disputes.
The second arrest came in Jordan on September 29. A man identified by Reuters' sources as Saif al-Din Khader was detained there and is reportedly cooperating with the FBI. Whether that cooperation contributed to the Pennsylvania arrest is something the FBI hasn't confirmed.
As for what was actually taken, Reuters' analysis of a data sample shared by ShinyHunters found extensive personal information on FBI employees, details about sensitive job functions, and psychiatric and medical records. An internal FBI notice reportedly confirmed the breach to staff.
The FBI's own post-mortem points to a contractor failing to apply a security patch that had been explicitly issued to protect the platform. Assistant Director Brett Leatherman of the FBI's Cyber Division confirmed this to Reuters on October 5, and said the contractor has since been removed. The FBI won't say who the contractor was or which platform was involved, but two sources told Reuters it was Accenture and Oracle's PeopleSoft HR software respectively. Accenture's response to Reuters was a masterclass in saying nothing, offering only that it was "proud to support the mission of the FBI."
ShinyHunters, for their part, claim the attack was retaliatory. They say a May FBI advisory that painted them as a cybercriminal group responsible for large-scale data theft and extortion contained false information. The FBI's position is rather less sympathetic: the agency alleges the group has breached more than 140 organisations and extorted at least $70 million since last year alone.