FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack

The suspect is a Canadian citizen arrested in Pennsylvania in connection with the ShinyHunters investigation. The FBI has not identified him, and no charges have been made public. That means his alleged role remains unproven. The arrest is nevertheless significant because it targets a suspected co-conspirator after sensitive FBI information was reportedly stolen.

The New York Times reported that the arrest involved suspicion of stealing FBI data. A law enforcement source told CBS News that the suspect is believed to have been directly involved in the hack. Patel’s post did not confirm that connection. It described ShinyHunters as the group believed responsible for the FBIjobs.gov incident.

The FBI says it will work with partners to disrupt ShinyHunters and its associates. Other suspected co-conspirators remain free, according to CBS News. The article does not identify the evidence behind this arrest or say whether it resulted from cooperation by another suspect.

ShinyHunters is described by the FBI as a cybercriminal group specializing in large-scale data breaches and extortion. The FBI alleges that it has breached more than 140 organizations and collected at least $70 million in extortion payments since last year. The group said it breached the FBI’s jobs portal and stole sensitive information.

Extortion begins when criminals take data and demand money from the affected organization. They may threaten to publish the information or use its exposure as leverage. In this case, ShinyHunters shared a sample of data and publicly discussed the FBI breach. The article does not state that ShinyHunters encrypted FBI systems or disrupted operations.

The FBI says the group targeted it partly because of a May advisory that ShinyHunters claims made false statements about the group. The FBI is pursuing alleged members and associates. ShinyHunters denied that the man arrested in the Netherlands belonged to the group.

ShinyHunters said it stole sensitive data on almost all FBI agents and job applicants from the FBI’s jobs portal. The article does not provide a complete number of records. It does report that a sample contained extensive personal information about FBI employees. That makes the breach important beyond ordinary contact details.

The exposed material reportedly included details of sensitive job roles, plus psychiatric and medical information. An internal FBI notice confirmed that hackers obtained employee information, according to a source cited by CBS News. Reuters found the sample’s contents through its own analysis. These details could reveal information about employees and their work.

The FBI’s review was still underway when the article was published. Officials had confirmed employee information was obtained, but had not named the platform or outside organization publicly. The FBI said the incident followed a contractor’s failure to install a required security patch. The article does not quantify the full dataset.

The breach resulted from a security failure on a platform managed by an outside organization, according to the FBI’s review. A security patch is an update intended to fix a known weakness. If it is not installed, attackers may be able to exploit that weakness. Here, the failure occurred outside the FBI’s direct platform management.

Brett Leatherman of the FBI said a contractor failed to implement a patch explicitly issued to secure the platform. The FBI removed that contractor. Two sources told Reuters that the platform was PeopleSoft, Oracle’s human resources software, and that Accenture was the outside organization. Neither identification was confirmed publicly by the FBI.

The incident shows how an organization can be exposed through a supplier or service provider. The article does not describe the exact technical steps used in the hack. It does establish the chain: an outside platform, a missed security update, and attackers who obtained employee information. The FBI’s review had not publicly named the platform or organization.

The exposure matters because FBI employees’ personal, medical, and work-related information can identify people and reveal sensitive aspects of their lives. Medical and psychiatric details are especially private. Information about job roles may show who handles sensitive responsibilities. The article confirms that such categories appeared in a sample of the stolen data.

The article does not document a specific injury, threat, or misuse resulting from the exposure. Still, public disclosure of personal details can create privacy harms, while revealing sensitive roles can increase risks for employees and their families. Those are direct reasons agencies treat this type of information as sensitive. The data may also affect job applicants whose information was included.

The FBI has not released the platform’s name and was still reviewing the breach. It also has not publicly described the full dataset or every affected person. The FBI removed the contractor it blamed for failing to apply the security patch. Investigators are also pursuing suspected ShinyHunters associates.

Cybercrime investigations often cross borders because suspects, victims, digital systems, and evidence may be located in different countries. A suspect can be a citizen of one country, arrested in another, and investigated by agencies from a third. Cooperation helps authorities share evidence, make arrests, and pursue people who operate across jurisdictions. The article provides examples of this pattern.

The new suspect is a Canadian citizen arrested in Pennsylvania. Dutch police arrested another man under Dutch law with FBI support. Khader, detained in Jordan, is cooperating with the FBI, according to Reuters. The FBI says it has worked with partners to arrest multiple subjects. These actions show several countries contributing to one investigation.

The FBI has not said whether Khader’s cooperation led to the Pennsylvania arrest. The Dutch suspect’s police statement did not mention the FBI portal, and ShinyHunters denied he belonged to the group. The FBI says it will continue working with partners to disrupt the group and its associates wherever they operate.

Data extortion is a crime in which attackers steal information and use the threat of disclosure to pressure a victim for money. The value comes from the information’s sensitivity and the harm exposure could cause. Unlike an attack that encrypts files, data extortion can rely entirely on secrecy, reputational pressure, and privacy concerns.

In this case, ShinyHunters reportedly obtained employee information, sensitive job-role details, and psychiatric and medical data. The group also shared a sample of the material. Publishing a sample can demonstrate access and make a demand more credible. The article says ShinyHunters is an extortion group, but it does not report that the FBI’s systems were encrypted.

The FBI alleges that ShinyHunters has breached more than 140 organizations and received at least $70 million in extortion payments since last year. The group says it targeted the FBI over a May advisory. The FBI is now investigating the breach and seeking suspected members and associates.