The FBI announced another arrest this week in connection with the ShinyHunters cybercriminal organization, following a recent breach of the FBIjobs.gov domain. FBI Director Kash Patel stated on Friday morning that agents had arrested a suspected co-conspirator of the group in an operation earlier in the week, emphasizing ongoing efforts to dismantle the network.
This latest arrest, reportedly conducted in Pennsylvania and involving a Canadian national, is the third in recent weeks. On September 28, Saif al-Din Khader was arrested in Jordan. Khader, previously identified by journalists and researchers as a key ShinyHunters member, is reportedly cooperating with law enforcement to locate other members. Prior to that, the FBI and Dutch National Police announced the arrest of Pepijn van der Stap, another alleged member of the group.
The arrests follow a significant breach where ShinyHunters claimed to have taken over the FBIjobs.gov domain, defaced it, and stolen sensitive data on nearly all FBI employees. The group shared samples of the stolen data with news outlets, asserting they had obtained information including medical records, home addresses, phone numbers, and work areas within the FBI. The breach also reportedly exposed thousands of records belonging to local police officers collaborating with the FBI on task forces. The FBI issued an internal memo last week, warning employees about the breach and potential risks to them and their families.
The FBI reportedly traced the breach to an unidentified contractor at Accenture who failed to patch a vulnerable system. That contractor was subsequently fired this week. ShinyHunters, however, previously claimed to have breached the FBI through a vulnerability in Oracle software, which cybersecurity experts had highlighted in June.
The cybercriminal group initially boasted about the attack but later indicated they would not release the stolen information, stating they did not wish to escalate a feud with the FBI. They claimed this dispute began over an advisory from the FBI regarding their activities that they disagreed with.
In response to law enforcement actions, the FBI has reportedly taken down much of ShinyHunters' infrastructure over the past two weeks, hindering their efforts to restore platforms. The group moved its operations to Telegram this week but posted a message on Friday morning indicating they would not remain active on the platform much longer due to reported arrests of several members by the FBI.
