FBI Arrests Third Suspected ShinyHunters Co-Conspirator in FBI Jobs Portal Hack

Third ShinyHunters Suspect Arrested

The FBI has arrested another suspected co-conspirator of the ShinyHunters extortion group over the breach of the FBI's jobs portal, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters said in September that it had breached the portal and stolen sensitive data on almost all FBI agents and job applicants.

The FBI has not named the suspect and no charges have been made public. The suspect is a Canadian citizen who was arrested in Pennsylvania, according to The New York Times and CBS News, both citing unnamed sources. The Times reported that the arrest was made on suspicion of involvement in the theft of FBI data, while a law enforcement source told CBS News the suspect is believed to have been directly involved in the hack. An FBI spokesperson declined to comment on the Times report.

Patel's post calls ShinyHunters "the group believed to be responsible for the recent FBIjobs.gov incident" and does not say whether the suspect took part in the breach. He wrote that the FBI will keep working with partners "to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate." Other suspected co-conspirators are still free, the law enforcement source said.

Earlier Arrests in the Netherlands and Jordan

Reuters counts the new arrest as the third made public since news of the breach broke in late September. The FBI said in a statement reported by Reuters on October 3 that it had "already worked with partners to arrest multiple subjects."

Dutch police and the FBI arrested a 24-year-old Amsterdam man on September 15, identified to Reuters and CBS News as Pepijn van der Stap; Dutch police have not named him. The arrest came a week before ShinyHunters announced the breach on September 22. The FBI said in a video statement that he is one of the group's alleged leaders and that Dutch police made the arrest under Dutch law with FBI support. ShinyHunters told The Hacker News that he has no association with the group.

A suspect named by Reuters' sources as Saif al-Din Khader was detained in Jordan on September 29. Reuters, citing people familiar with the matter, reported that Khader is cooperating with the FBI. The FBI has not said whether the new arrest resulted from that cooperation.

What Was Stolen and How the Breach Happened

A Reuters analysis of a sample of the data shared by ShinyHunters found extensive personal information on FBI employees, details of sensitive job roles, and psychiatric and medical information. An internal FBI notice confirmed that hackers obtained employee information, a source told CBS News.

The FBI's review has so far found that the breach resulted from a security failure on a platform managed by an outside organization after "a contractor failed to implement a security patch explicitly issued to secure the platform," Brett Leatherman, assistant director of the FBI's Cyber Division, told Reuters on October 5. The FBI has removed the contractor but has not named the platform or the organization. Two sources told Reuters they are PeopleSoft, Oracle's human resources software, and Accenture. Accenture told Reuters it was "proud to support the mission of the FBI" and did not answer questions about the contractor.

ShinyHunters said it targeted the FBI over a May advisory that it says makes false claims about the group. The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.

Sources: The Hacker News