The FBI has arrested another suspected member of the ShinyHunters hacking group, the gang believed to be behind last month’s breach of the bureau’s jobs portal. FBI Director Kash Patel announced the arrest on October 9, writing that “our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group.”
Patel did not name the suspect or say where the arrest took place. The New York Times and CBS News, citing unnamed sources, reported that the suspect is a Canadian citizen arrested in Pennsylvania. According to the Times, the arrest was made on suspicion of involvement in the theft of FBI data. No charges have been made public, and an FBI spokesperson declined to comment on the reports.
The breach behind the arrests
ShinyHunters announced on September 22 that it had breached FBIjobs.gov, the bureau’s recruitment portal. As we reported at the time, the group claimed it used an Oracle PeopleSoft zero-day and then moved into FBI-managed AWS GovCloud infrastructure, stealing 2 to 3 terabytes of data. According to BleepingComputer, data samples confirmed exposure of employee details including home addresses, Social Security numbers, job assignments and family member information. The New York Times reported that an internal FBI memo said the agency assumed all employees were affected.
The FBI’s own account points to a missed update rather than an unknown flaw. Brett Leatherman, assistant director of the FBI’s Cyber Division, told Reuters on October 5 that “a contractor failed to implement a security patch explicitly issued to secure the platform.” The FBI has removed the contractor but has not named it or the platform. Two Reuters sources identified them as Accenture and Oracle PeopleSoft. Accenture told Reuters it was “proud to support the mission of the FBI” and did not answer questions about the contractor.
Third public arrest since the breach
Reuters counts this as the third arrest made public since news of the breach broke:
- September 15, Netherlands: Dutch police arrested a 24-year-old Amsterdam man, who Reuters and CBS News identified as Pepijn van der Stap. The FBI describes him as one of the group’s alleged leaders. ShinyHunters denies any association with him.
- September 29, Jordan: according to Reuters’ sources, a suspect known as “Rey” was detained in Jordan. Reuters named him as Saif al-Din Khader and reported that he is cooperating with the FBI. Jordanian state media confirmed an arrest without naming the person.
- October 9, United States: the arrest announced by Patel.
The FBI alleges that ShinyHunters has breached more than 140 organizations and collected at least $70 million in extortion payments since last year. Its recent claimed victims include healthcare distributor McKesson, which confirmed a data breach after ShinyHunters claimed the theft of 284 million patient records, and Carhartt, whose data breach exposed 12.9 million accounts.
Patel said the FBI will keep working with partners “to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.” A law enforcement source told CBS News that other suspected co-conspirators remain at large.
Sources
- BleepingComputer: FBI arrests another suspected ShinyHunters hacker after agency breach (October 9, 2026)
- The Hacker News: FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack (October 9, 2026)
[…] FBI Arrests Another Suspected ShinyHunters Member After FBI Jobs Portal Breach […]