The FBI has arrested another suspected member of the ShinyHunters extortion group in connection with last month’s breach of the bureau’s own jobs portal, Director Kash Patel announced October 9 on X.
Patel said agents had taken into custody “another suspected co-conspirator” of the group believed responsible for the FBIJobs.gov incident, which occurred on a platform managed by a third-party vendor. He did not identify the suspect or confirm where the arrest took place, but called it “the latest arrest this FBI has made in a matter of days” as the bureau works to “dismantle the group, pursue new leads and evidence, and act quickly.”
According to reporting from The New York Times, the suspect is a Canadian citizen arrested in Pennsylvania and considered a primary co-conspirator in the intrusion. No charges have been made public.
Background on the breach
ShinyHunters told BleepingComputer in September that it gained access to FBI systems by exploiting an alleged Oracle PeopleSoft zero-day vulnerability, then moved laterally into FBI-managed AWS GovCloud infrastructure. The group claimed to have exfiltrated between 2TB and 3TB of data, including records on current and former FBI employees, job applicants, medical and psychiatric files, and internal service records. Data samples reviewed by media outlets showed exposed home addresses, Social Security numbers, sensitive job assignments, and family member details. An internal FBI memo reportedly assumed the breach had affected all employees. The FBI has attributed the root cause to a third-party contractor-managed platform that failed to apply a security update.
A widening dragnet
This arrest follows a string of law enforcement actions against the group. On September 15, Dutch police arrested a 24-year-old Amsterdam resident, identified as Pepijn van der Stap (known online as “Umbreon”), though ShinyHunters publicly denied he was a member. Shortly after, the FBI’s Cyber Division publicly urged ShinyHunters members to turn themselves in, with Assistant Director Brett Leatherman warning that “arrests have a way of changing who is willing to talk.”
Days later, a suspected member known as “Rey,” identified as Saif al-Din Khader, was reportedly detained in Jordan and began cooperating with investigators. Around the same time, the group’s longtime media contact went silent on Telegram and that account was later deleted, another affiliate shut down a messaging account, and the group’s leak site went offline before a new one resurfaced, suggesting some members remain active despite the mounting pressure.