The FBI has arrested another suspect connected to the ShinyHunters cybercriminal group, marking the third known detention in roughly two weeks as the bureau works to unravel the network behind a breach of its own jobs portal.
FBI Director Kash Patel confirmed the arrest in a statement Friday, saying agents detained a “suspected co-conspirator of the ShinyHunters group” in an operation conducted earlier in the week. Patel said the bureau is working “non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” and vowed continued cooperation with international partners. The FBI has not released further details, but the New York Times reported the arrest took place in Pennsylvania and involved a Canadian national.
The arrest follows two prior detentions tied to the same case. Multiple FBI sources told Reuters that Saif al-Din Khader, previously identified by journalists and researchers as a key ShinyHunters figure, was arrested in Jordan on September 28. Khader has reportedly agreed to cooperate with law enforcement to help identify other members of the group. Days earlier, the FBI and Dutch National Police announced the arrest of Pepijn van der Stap, another alleged member.
Background on the breach
ShinyHunters took over the FBIjobs.gov domain, defaced it, and exfiltrated sensitive data on nearly every FBI employee, including medical records, home addresses, phone numbers, and details about their areas of work. Thousands of records belonging to local police officers who partner with the FBI on task forces were also exposed. The FBI sent an internal memo warning staff of potential danger to themselves and their families.
The bureau has reportedly traced the intrusion to an unpatched system managed by an Accenture contractor, who was fired this week according to Reuters. ShinyHunters previously claimed the breach exploited a vulnerability in Oracle software that drew scrutiny from security researchers in June.
The group had said it would not leak the stolen data and framed the attack as retaliation over a law enforcement advisory it disputed. Since then, the FBI has dismantled much of ShinyHunters’ infrastructure and blocked efforts to rebuild it. The group briefly resurfaced on Telegram this week before announcing plans to abandon the platform, citing the arrests of several members.