The FBI has arrested another suspected member of the ShinyHunters cybercrime group as investigators continue pursuing those responsible for a major breach of the agency’s recruitment systems. The latest detention follows several international law enforcement operations targeting individuals allegedly connected to the hacking network.
FBI Director Kash Patel announced the arrest on October 9, confirming that investigators had detained another suspected co-conspirator. Although the agency did not identify the individual, media reports indicate that the suspect is a Canadian citizen arrested in Pennsylvania.
The arrest is connected to a September cyberattack involving FBIJobs.gov, the agency’s recruitment website. The intrusion exposed sensitive information about FBI personnel and job applicants, raising concerns about the security of internal government records.
ShinyHunters claimed responsibility for the breach and alleged that it had stolen between two and three terabytes of information. Samples shared with journalists contained personal details, including home addresses, Social Security numbers, family information, and sensitive employment records.
Some exposed material reportedly included medical and psychological information associated with FBI employees. The agency has not publicly confirmed the full volume of stolen data, although internal communications reportedly warned that information concerning all employees could have been affected.
Investigators have linked the incident to security weaknesses in a system operated by an external contractor. The FBI subsequently determined that the contractor had failed to install a security update intended to protect the affected platform and removed the contractor from its operations.
The latest detention follows two other arrests involving suspected ShinyHunters associates. Dutch authorities arrested 24-year-old Pepijn van der Stap in Amsterdam on September 15, while Jordanian authorities reportedly detained Saif al-Din Khader, known online as “Rey,” later that month.
According to Reuters, Khader has been cooperating with investigators. However, authorities have not confirmed whether information obtained from him contributed to the latest arrest.
The enforcement actions appear to have coincided with disruptions to ShinyHunters’ online operations. Several communication accounts associated with the group disappeared, and its data leak website temporarily went offline before a replacement appeared.
ShinyHunters has been linked to numerous data theft and extortion campaigns targeting major organizations. The group frequently exploits compromised credentials and cloud services to steal sensitive information before demanding payment to prevent its publication.
The FBI has not disclosed charges against the newly arrested suspect, and other alleged participants remain under investigation. Despite the recent arrests, the appearance of a replacement leak site suggests that the wider ShinyHunters operation has not been completely dismantled.