FBI Arrests Another Suspected ShinyHunters Member Over Breach of FBI Employee Data

The FBI has arrested another suspected member of ShinyHunters, the hacking group the bureau believes is behind a breach that exposed sensitive information about its employees, FBI Director Kash Patel said Friday.

The New York Times first reported the arrest, identifying the suspect as a Canadian man taken into custody in Pennsylvania, according to Nextgov/FCW. Patel said agents arrested the man earlier this week, describing him as another suspected co-conspirator in the intrusion involving FBIjobs.gov, the bureau’s recruiting site, which runs on a platform managed by a third-party vendor. The bureau’s statement did not name the suspect, list charges or describe his alleged role.

A widening international roundup

The arrest is the latest in a fast-moving, multi-country effort. According to Reuters reporting cited by Nextgov/FCW, suspected ShinyHunters member Saif al-Din Khader was detained in Jordan and is cooperating with investigators, helping law enforcement locate other members of the group. Dutch authorities have also arrested an alleged leader of the group, an action the FBI announced on Sept. 29; at that time, FBI Cyber Division chief Brett Leatherman said that suspect and his alleged co-conspirators had breached more than 140 organizations and collected at least $70 million in extortion payments since last year.

The stakes for the bureau are unusually personal. ShinyHunters supplied Nextgov/FCW with an apparent sample of the stolen data containing roughly 5,000 entries, including names, home addresses, phone numbers and information about relatives. The records also identified personnel working in intelligence and surveillance roles, the outlet reported.

A missed patch, and a vendor removed

The FBI has attributed the intrusion to a missed security update. The bureau has removed the Accenture contractor responsible for the affected platform and says it has taken steps to limit further risk and protect its workforce. ShinyHunters has said it would not publish the stolen FBI data, but officials note the information could still be sold later to foreign intelligence services or other buyers.

Patel said the bureau would keep working with partners to disrupt what remains of the group wherever its members operate. With suspects now in custody on three continents and at least one reportedly cooperating, investigators appear focused on rolling up the rest of the network before the stolen personnel records change hands.

Reporting based on coverage by Nextgov/FCW.