FBI Arrests Another Suspect in ShinyHunters Case — the Crew Accused of Hacking the FBI's Own Jobs Site

There is a particular boldness in hacking the FBI itself — and, according to the FBI, that is what ShinyHunters did, breaking into a platform behind the bureau's own recruitment site in September. On Friday, Director Kash Patel announced the bureau had arrested another suspected member of the group, the latest in what he described as a run of arrests "in a matter of days" as agents work to dismantle the network.

Officials did not release the identity of the person arrested. The New York Times reported the suspect is a Canadian citizen arrested in Pennsylvania. The bureau has not said what role the suspect is alleged to have played, and no charging documents have been made public in connection with the announcement.

The breach of the hunters' hunter

The September intrusion targeted a platform managed by a third-party vendor behind FBIjobs.gov, the site through which the bureau recruits agents and staff. Reuters previously reported on an internal memo circulated across the bureau saying officials were operating under the assumption that all current and former employees had been exposed — personnel information of exactly the kind an extortion crew values.

How the group got in has not been disclosed. What the FBI says about the group's broader operation is sweeping: Assistant Director Brett Leatherman has said the crew allegedly breached more than 140 organizations and taken at least $70 million in extortion payments. ShinyHunters' method, as described by investigators and security researchers, is to compromise corporate cloud and software accounts — often through phishing and stolen credentials — steal the data inside, and threaten to publish it unless the victim pays.

A net closing on several continents

Friday's arrest is the third public move against the group in under a month. On September 29, Patel announced that Dutch National Police had arrested one of the group's alleged leaders; Dutch police said they had taken a 24-year-old man into custody, and Reuters reported the arrest came in a September 15 raid on an Amsterdam cybersecurity office involving flash-bang grenades.

"This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," Patel said. For the organizations counting themselves among the 140, the practical questions are older and duller than the headlines: which credentials were phished, which vendor had the keys, and why a jobs portal's vendor platform held data worth assuming the worst about. The bureau has not answered those yet. Its investigation, by every public signal, is still adding names.