A hacking group breached the FBI's own jobs portal — and investigators are now arresting its suspected members across three continents.
October 10, 2026 — The FBI has arrested another suspected co-conspirator of ShinyHunters, the extortion group that said in September it had breached the bureau's jobs portal, FBIjobs.gov, and stolen data on almost all FBI agents and job applicants. Director Kash Patel announced the arrest on October 9. The suspect is unnamed, and no charges are public.
Image: A government jobs portal on a glowing screen behind a broken padlock, with handcuffs beside it, symbolising the FBI jobs portal breach and arrests. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.
Editor's Highlight: The FBI says this breach happened because a contractor failed to apply a security patch it had explicitly issued — a routine vendor failure, and a warning for every organisation that outsources its platforms.
Table of Contents
- Key Facts
- What the FBI Has Confirmed About the Arrest
- Three Arrests Made Public in Under a Month
- What Was Taken From the Jobs Portal
- A Missed Patch Opened the Door
- Why the Stolen Data Carries National Security Risk
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
| Latest arrest announced | October 9, 2026, by Director Kash Patel |
| Suspect | Unnamed; reported as a Canadian citizen arrested in Pennsylvania |
| Group targeted | ShinyHunters extortion group |
| System breached | FBIjobs.gov, on a platform managed by a third-party vendor |
| Breach claimed | September 2026; data on almost all agents and applicants |
| Stated cause | Contractor failed to implement a security patch the FBI says it issued |
| Wider allegation | 140+ organisations breached, at least $70 million extorted since last year, FBI alleges |
| Charges | None made public |
What the FBI Has Confirmed About the Arrest
Kash Patel said agents arrested the suspect earlier in the week, describing the person as another suspected co-conspirator of ShinyHunters, "the group believed to be responsible for the recent FBIjobs.gov incident," which he said "occurred on a platform managed by a third-party vendor."
According to The New York Times and CBS News, both citing unnamed sources, the suspect is a Canadian citizen arrested in Pennsylvania. A law enforcement source told CBS News the suspect is believed to have been directly involved in the hack, and that others are still free.
Newsroom Focus: The nationality and location details come from unnamed sources — not from the FBI itself, which declined to comment on the Times report.
Three Arrests Made Public in Under a Month
Reuters counts this as the third arrest made public since late September. The earlier two were in the Netherlands and Jordan.
| Where | When |
| Netherlands | September 15 — a 24-year-old Amsterdam man |
| Jordan | September 29, according to Reuters sources |
| Pennsylvania, US | Announced October 9; arrested earlier that week |
The Netherlands arrest came a week before ShinyHunters announced the breach on September 22. The FBI called the man an alleged group leader in a video statement. Dutch police have not named him; Reuters and CBS News identified him as Pepijn van der Stap, and ShinyHunters told The Hacker News he has no association with the group.
The Jordan suspect was named by Reuters sources as Saif al-Din Khader, who Reuters says is cooperating with the FBI. The bureau has not said whether the newest arrest resulted from that cooperation.
What Was Taken From the Jobs Portal
ShinyHunters said in September it had stolen data on almost all FBI agents and job applicants. A Reuters analysis of a sample the group shared found extensive personal information on employees, sensitive job roles, and psychiatric and medical information.
Nextgov/FCW reported the group supplied it with a sample of roughly 5,000 entries, including names, home addresses, phone numbers, relatives' information, and personnel in intelligence and surveillance roles.
Tech Analysis: A jobs portal may sound low-value, but it concentrates exactly what an extortion group wants: identities, home addresses, family details, role information and health-related data.
A Missed Patch Opened the Door
The FBI's review found the breach resulted from a security failure on a vendor-managed platform. Brett Leatherman, assistant director of the FBI's Cyber Division, told Reuters on October 5 it happened after "a contractor failed to implement a security patch explicitly issued to secure the platform." The FBI removed the contractor.
The FBI named neither platform nor organisation. Two Reuters sources identified them as PeopleSoft, Oracle's HR software, and Accenture. Accenture told Reuters it was "proud to support the mission of the FBI," and did not answer questions about the contractor.
Practical Takeaway: A patch notice is not a patch applied. If a vendor runs your system, verify installation — and audit internet-facing HR platforms first, as they hold personal data.
Why the Stolen Data Carries National Security Risk
Experts told the Associated Press the data appeared to be the type routinely accessed in a breach, but the hack still had alarming national security implications. Stolen records could expose agents and their families — spouses' identities were also said to be obtained — to extortion, swatting and harassment.
ShinyHunters has said it would not publish the data, Nextgov/FCW reported — but it could still be sold to foreign intelligence services or other buyers later.
The group said it targeted the FBI over a May advisory describing it as specialising in data breaches and extortion — a description it calls false. The FBI alleges the group has breached more than 140 organisations and taken at least $70 million in extortion payments since last year.
Bottom Line
A third publicly known arrest in under a month shows the ShinyHunters investigation accelerating across three continents. But the latest suspect is unnamed, no charges are public, and others reportedly remain at large. Watch for court filings naming the Pennsylvania suspect.
FAQ
Who was arrested in Pennsylvania?
The FBI has not named the suspect and no charges are public. The New York Times and CBS News, citing unnamed sources, reported a Canadian citizen arrested in Pennsylvania, believed to be directly involved in the hack.
What is ShinyHunters?
ShinyHunters is a cybercriminal group that, according to a May FBI advisory, specialises in large-scale data breaches and extortion. The FBI alleges 140+ organisations breached and at least $70 million extorted since last year.
How did the FBI jobs portal breach happen?
According to FBI Cyber Division assistant director Brett Leatherman, a contractor failed to implement a security patch explicitly issued for the vendor-managed platform, and the FBI removed the contractor. Reuters sources identified the platform as Oracle's PeopleSoft and the organisation as Accenture.
What data was exposed?
Reporting on a group-shared sample described employee personal information, sensitive job roles, and psychiatric and medical information, across roughly 5,000 entries.
Is the investigation over?
No. A law enforcement source told CBS News other co-conspirators are still free, and Patel said the FBI will keep disrupting what remains of the group.
Sources
- The Hacker News — FBI arrests another ShinyHunters suspect (October 9, 2026)
- Associated Press via KCAU 9 — FBI arrests suspect in ShinyHunters hack (October 9, 2026)
- Nextgov/FCW — FBI arrests another ShinyHunters suspect (October 9, 2026)
- Hero image: AI-generated illustration / Red Eye Eagle News, original illustration.
Join the conversation
Comments
Post a Comment