# Bureau Detains Third Suspect After Jobs Portal Breach

The FBI arrested a third person allegedly connected to the ShinyHunters cybercriminal group this week, following a breach of its jobs portal that exposed sensitive employee information. FBI Director Kash Patel announced the arrest on Friday, stating that agents detained the suspected co-conspirator earlier in the week. The New York Times reported the arrest occurred in Pennsylvania and involved a Canadian national. ShinyHunters took over the FBIjobs.gov domain and stole troves of sensitive data on nearly every FBI employee. The group also exposed thousands of records about local police officers working with the bureau on task forces.

## Third Arrest in Series of FBI Operations

FBI Director Kash Patel said on Friday that agents arrested another suspected co-conspirator of the ShinyHunters group in an operation conducted earlier this week. The arrest took place in Pennsylvania and involved a Canadian national, the New York Times reported.

Patel said the arrest is the latest the FBI has made in a matter of days involving this network. He said the bureau is working to dismantle the group, pursue new leads and evidence, and act quickly to disrupt what is left of ShinyHunters and their associates.


## Earlier Arrests and Cooperation

Multiple FBI sources told Reuters that Saif al-Din Khader was arrested in Jordan on September 28 after journalists and researchers previously identified him as part of the group. Khader is alleged to have agreed to assist the FBI and other agencies in locating additional ShinyHunters members.

The FBI and Dutch National Police announced the arrest of Pepijn van der Stap, another alleged member of ShinyHunters. These arrests came after the group took over the FBIjobs.gov domain and defaced it.


## Stolen Data and Internal Warning

The group initially shared samples of the stolen data with news outlets to verify that it had obtained sensitive information on agents, including their medical records, home addresses, phone numbers and areas of work within the FBI. The stolen data also included thousands of records on local police working with the bureau on joint task forces.

The bureau sent an internal memo to employees warning them of the breach and the potential danger to them and their families. The group sent messages to several news outlets saying it would not release the stolen information and did not want further conflict with the FBI, which they said started because of an advisory about their actions that they disagreed with.


## Breach Traced to Contractor

The FBI traced the breach to an unidentified contractor at Accenture who did not patch a vulnerable system, according to reports. The contractor was fired this week, Reuters reported.

The hackers claimed they breached the FBI through a vulnerability in Oracle software that was spotlighted by cybersecurity experts in June. The FBI did not respond to requests for details about the latest arrest.


## Infrastructure Takedown and Group Response

The FBI dismantled much of the group's infrastructure over the last two weeks and blocked attempts to restore its platforms. The group moved its operations to Telegram this week but posted a message on Friday morning saying it no longer planned to remain on the platform.

The group wrote that several of its members have been arrested by the FBI. The message said they will not remain active on Telegram for much longer.


## Steps for Individuals Whose Information May Be at Risk

Anyone who received the internal warning should watch for phishing attempts that may reference specific work details or personal information. Secure personal accounts with unique passwords and enable multi-factor authentication on all services where it is available.

Be cautious of unexpected messages or contact attempts, especially from unknown parties claiming to have information about your work or family. Report any suspicious communications to the appropriate security office. Monitor accounts for unusual activity and consider reviewing what personal information is publicly available online.
1. Watch for phishing attempts that may reference specific work details or personal information
2. Secure personal accounts with unique passwords
3. Enable multi-factor authentication on all services where available
4. Be cautious of unexpected messages or contact attempts from unknown parties
5. Report suspicious communications to the appropriate security office
6. Monitor accounts for unusual activity
7. Review what personal information is publicly available online

## Who did the FBI arrest in connection with ShinyHunters?

The FBI arrested at least three people allegedly connected to ShinyHunters. Saif al-Din Khader was arrested in Jordan on September 28. The FBI and Dutch National Police also arrested Pepijn van der Stap. A third arrest occurred in Pennsylvania this week and involved a Canadian national, according to the New York Times.

## What information did ShinyHunters steal from the FBI?

ShinyHunters stole troves of sensitive data on nearly every FBI employee, including medical records, home addresses, phone numbers and areas of work within the FBI. The stolen data also included thousands of records on local police working with the bureau on joint task forces.

## How did the hackers access the FBI jobs site?

The FBI traced the breach to an unidentified contractor at Accenture who did not patch a vulnerable system. The hackers claimed they breached the FBI through a vulnerability in Oracle software that was spotlighted by cybersecurity experts in June. Accenture fired the contractor this week, according to Reuters.

## Is ShinyHunters still operating?

The FBI dismantled much of the group's infrastructure over the last two weeks and blocked efforts to restore its platforms. The group moved its operations to Telegram this week but posted a message on Friday saying it no longer planned to remain on that platform and that several of its members have been arrested.

## Did ShinyHunters release the stolen FBI data?

ShinyHunters sent messages to several news outlets saying it would not release the stolen information and did not want further conflict with the FBI. The group initially shared samples of the stolen data with news outlets to verify the breach but said the conflict started because of an FBI advisory about their actions that they disagreed with.

Source: The Record
Published: 2026-10-12T00:27:46+00:00