FBI Arrests Another Suspected ShinyHunters Hacker Linked to FBIJobs.gov Breach

The FBI has arrested another suspected ShinyHunters co-conspirator as investigators pursue the group believed to be behind the FBIJobs.gov breach.

Director Kash Patel announced the arrest on October 9, saying the incident affected a third-party-managed platform. The announcement follows several recent actions against suspected members of the hacking network.

“Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group,” Patel said. He added that investigators were pursuing new leads and evidence while working with partners to disrupt the group and its associates. His statement did not name the suspect, disclose charges, or explain the person’s alleged role.

The New York Times identified the suspect as a Canadian citizen arrested in Pennsylvania. Patel’s announcement did not include that detail. The arrest remains part of an active investigation, and the allegations do not establish the suspect’s guilt.

The FBIJobs.gov incident was discovered in late September and exposed employee information held in an unclassified system. Although the website supports recruitment, reports indicate the stolen records extended beyond job applicants to bureau personnel.

FBI Cyber Assistant Director Brett Leatherman said the breach resulted from a security failure on a third-party platform after a contractor failed to install a security patch issued to protect it.

FBI Arrests Hacker Linked to ShinyHunters Breach

The bureau subsequently removed the contractor and said it had taken steps to reduce further risk and protect employees, according to ABC News.

ShinyHunters previously told BleepingComputer that it exploited an alleged Oracle PeopleSoft zero-day flaw and then moved into FBI-managed AWS GovCloud infrastructure. These claims describe the attackers’ account, not a fully confirmed attack chain.

The FBI’s explanation instead points to an available security update that was not installed. Public reporting has not resolved that difference.

The group also claimed it stole between two and three terabytes of data. Samples BleepingComputer reviewed contained home addresses, Social Security numbers, sensitive job assignments, and family information. The claimed total should not be treated as an independently verified measure of the breach.

The latest arrest follows the arrest of an alleged ShinyHunters leader in the Netherlands. Dutch police detained a 24-year-old Amsterdam suspect on September 15, with support from FBI investigators. Authorities described him as an alleged leader, while ShinyHunters denied that he belonged to the group.

Separately, a suspected ShinyHunters member detained in Jordan reportedly began helping investigators. Reuters identified him as Saif al-Din Khader, allegedly known online as “Rey.” Sources said he was helping identify other members, although the FBI did not confirm that specific detention.

ABC News reported that an internal notice listed exposed names, addresses, contact details, Social Security numbers, birth dates, and emergency contacts.

Sources said the bureau was treating every employee’s personal information as potentially compromised. The FBI urged affected staff to remain alert and avoid suspicious calls.

The arrests have increased pressure on ShinyHunters, but they do not prove the operation has ended. BleepingComputer reported that a new leak site appeared after an earlier site went offline, suggesting some members remained active. Patel said international cooperation would continue wherever the group’s remaining members operate.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post FBI Arrests Another Suspected ShinyHunters Hacker Linked to FBIJobs.gov Breach appeared first on Cyber Security News.