FBI arrests another suspected ShinyHunters member after breach of its systems

FBI Director Kash Patel announced on Friday the arrest of another suspected member of the ShinyHunters extortion group, which is linked to the recent breach of the bureau's systems.

"Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor," Patel wrote on X. He noted it was the latest of several arrests made in recent days as the bureau works to dismantle the network.

The suspect's name and the charges have not been disclosed publicly. According to The New York Times, the detainee is a Canadian citizen arrested in Pennsylvania and considered a primary co-conspirator in the intrusion.

How the breach happened

In September, ShinyHunters told BleepingComputer they had entered FBI systems by exploiting an alleged Oracle PeopleSoft zero-day, then moved laterally into FBI-managed AWS GovCloud infrastructure. The hackers claimed to have stolen between 2TB and 3TB of data, including information on current and former employees, job applicants, medical and psychiatric records, and internal service files.

Samples shared with journalists confirmed the leak of home addresses, Social Security numbers, sensitive job assignments and details about employees' family members. An internal bureau memo, per the NYT, assumed the incident affected all employees. The FBI later said the breach stemmed from a contractor-managed platform that failed to install a security update.

A string of arrests

After the hack, the bureau sharply increased pressure on the group. On September 15, Dutch police arrested a 24-year-old Amsterdam man, Pepijn van der Stap, known online as "Umbreon." ShinyHunters denied any link, saying: "That individual has no association with us. Frankly, we are laughing."

Soon after, the FBI took the unusual step of publicly urging members to turn themselves in. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left," warned Cyber Division Assistant Director Brett Leatherman. "The longer you stay in this, the more we learn about you."

Days later, a suspect known as "Rey" was reportedly detained in Jordan — identified as Saif al-Din Khader, who sources say began cooperating with investigators.

Around the same time, the group's main representative, who had talked to reporters for two years, went silent on Telegram, and the account was deleted. The leak site went offline, though a new one later appeared — a sign that some members remain active.

Who are ShinyHunters

ShinyHunters is an extortion crew that steals data from web applications and cloud SaaS platforms and demands ransom under threat of publication. In recent years, breaches under the name have hit Google, Cisco, PornHub and Match Group. The group has run voice-phishing campaigns against Okta, Microsoft and Google accounts and was behind a May attack on Instructure Canvas.

"We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," Patel concluded.

Source: Bleeping Computer