Skip to content
Today
Sections

Security Reports disagree14 publishers 2 min read Published Updated

Arrests of ShinyHunters suspects reach at least three in two weeks after FBIjobs.gov breach

FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.

The Watch · Security desk

Send a correction

Breach exposed task-force police; group claims agent data How the FBIjobs.gov breach reaches agents, task-force police, the group itself and a suspect who allegedly agreed to help find other members.

FBI agents: group says its samples show medical records, home addresses, phone numbers and work areas. Task-force police: thousands of records exposed. ShinyHunters: said it would not release the data and did not want to escalate the feud. Khader: allegedly agreed to help locate other members.

Breach exposed task-force police; group claims agent data
WhoHowKindClaim
FBI agentsGroup says samples it shared show agents' medical records, home addresses, phone numbers and areas of workexposure5
Local task-force policeThousands of records about officers who work with the FBI on task forces were exposedexposure9
ShinyHuntersSaid it would not release the stolen information and did not want to escalate the feud with the FBIdecision14
Saif al-Din KhaderAllegedly agreed to help the FBI and other agencies locate other ShinyHunters memberscapability3

What happened

  • Reuters reported that Saif al-Din Khader, whom journalists and researchers had named as a key ShinyHunters member, was arrested in Jordan on September 28.
  • Before Khader's arrest, the FBI and the Dutch National Police announced the arrest of another alleged member, Pepijn van der Stap.
  • The New York Times reported that this week's arrest took place in Pennsylvania and involved a Canadian national.
  • The breach took data on nearly every FBI employee, and it also exposed thousands of records on local police officers who serve on FBI task forces.

Why it matters

  • What it sets up precedent Khader has reportedly agreed to help find other members, so investigators have a former insider to work from, and more arrests in more than one country are the likely next step.
  • Who's exposed exposure Agents' home addresses and medical records stay unpublished only on the group's word, and no arrest recalls copies already taken or shared with reporters.
  • What it limits constraint Its infrastructure is seized and it is leaving Telegram, so defenders lose the public channel they used to watch the group and will not know where it regroups until it reappears.

"This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," Patel said [6]. "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," he said [8]. The reported detentions number at least three [18] and span three jurisdictions: Jordan, Pennsylvania, and an arrest announced with Dutch police [19]. The FBI did not respond to requests for details on the latest arrest [10].

The group's own channels show it scattering. Over the past two weeks the FBI took down much of its infrastructure, and law enforcement has blocked its attempts to restore its platforms [22]. ShinyHunters moved operations back to Telegram this week. On Friday morning it posted that it would not stay [16]. "We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI," the group said [17].

Signs of escalation are harder to find. ShinyHunters told several news outlets it would not release the stolen information and did not want to escalate the feud [14]. Since the arrests began, its public moves have pointed toward retreat, and nothing in the reported record shows retaliation so far [14][16]. The group said the feud began over an FBI advisory about its actions that it disagreed with [15].

The pledge not to publish is a statement of intent and nothing more. The group has already handed samples to news outlets to prove it held agents' medical records, home addresses, phone numbers and areas of work [5]. Last week an internal FBI memo warned employees about the potential danger to them and their families [7].

The reported way in was a missed patch. The hackers claimed they got in through a vulnerability in Oracle software that cybersecurity experts had spotlighted in June [13]. The FBI reportedly traced the breach to an unidentified Accenture contractor who did not patch a vulnerable system [11]. If the hackers' account is accurate, a flaw publicized in June was still unpatched when they got in [11][13]. Reuters reported that the contractor was fired this week [12].

What to watch

  • Charging documents or extradition filings for the Pennsylvania suspect or for Khader would show what the FBI can prove and where the cases will be tried.
  • Where ShinyHunters resurfaces after Telegram, and whether any FBI employee or task-force records appear there despite its pledge.
  • Confirmation from the FBI or Accenture of which system went unpatched, and whether it was the Oracle flaw the hackers named.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption
Not scored
Hype gap+22
Incentives68
Confidence64

Perspective Coverage

14 publishers
Builder
Builder 23%
Operator
Operator 57%
Investor
Investor 20%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    At least two other suspected ShinyHunters members have been detained over the last two weeks after the group took over the FBIjobs.gov domain, defaced it and stole sensitive data on nearly every FBI employee.

    Reported SupportedView cited source
  2. [2]

    Multiple FBI sources told Reuters that Saif al-Din Khader was arrested in Jordan on September 28 after previously being identified by journalists and researchers as a key member of the group.

    Reported Supported Source: Reuters, citing multiple FBI sourcesView cited source
  3. [3]

    Khader allegedly agreed to cooperate with the FBI and other law enforcement agencies to help locate other members of ShinyHunters.

    Reported SupportedView cited source
  4. [4]

    On Friday morning, FBI Director Kash Patel released a statement saying agents "arrested another suspected co-conspirator of the ShinyHunters group" in an operation conducted earlier this week.

    Reported SupportedView cited source
  5. [5]

    The group shared samples of the stolen data with news outlets to verify it had obtained sensitive information on agents, including medical records, home addresses, phone numbers and areas of work within the FBI.

    Reported SupportedView cited source
  6. [6]

    "This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,"

    Reported Supported Source: FBI Director Kash Patel, statementView cited source
  7. [7]

    The FBI sent an internal memo last week warning employees of the breach and the potential danger to them and their families.

    Reported SupportedView cited source
  8. [8]

    "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate,"

    Reported Supported Source: FBI Director Kash Patel, statementView cited source
  9. [9]

    The breach also exposed thousands of records about local police officers who work with the FBI on task forces.

    Reported SupportedView cited source
  10. [10]

    The FBI did not respond to requests for details about the arrest.

    Reported SupportedView cited source
  11. [11]

    The FBI reportedly traced the breach back to an unidentified contractor at Accenture who did not patch a vulnerable system.

    Reported SupportedView cited source
  12. [12]

    The Accenture contractor was fired this week, according to Reuters.

    Reported Supported Source: ReutersView cited source
  13. [13]

    The hackers previously claimed they breached the FBI through a vulnerability in Oracle software that was spotlighted by cybersecurity experts in June.

    Reported Supported Source: ShinyHunters' own claimView cited source
  14. [14]

    ShinyHunters told several news outlets it would not release the stolen information and did not want to escalate the feud with the FBI.

    Reported Supported Source: ShinyHunters, messages to news outletsView cited source
  15. [15]

    ShinyHunters said the feud started because of an FBI advisory about their actions that they disagreed with.

    Reported Supported Source: ShinyHuntersView cited source
  16. [16]

    The group moved its operations back to Telegram this week but posted a message on Friday morning saying it no longer planned to remain on the platform.

    Reported SupportedView cited source
  17. [17]

    "We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI,"

    Reported Supported Source: ShinyHunters, Telegram postView cited source
  18. [18]

    At least three suspected ShinyHunters members have been detained in roughly two weeks.

    Derived Supported
  19. [19]

    The reported arrests touch three jurisdictions: Jordan, Pennsylvania, and an arrest announced with the Dutch National Police.

    Derived Supported
  20. [20]

    The New York Times reported that the arrest was conducted in Pennsylvania and involved a Canadian national.

    Reported Contested Source: The New York Times, as reported by The RecordView cited source
  21. [21]

    Before Khader's arrest, the FBI and the Dutch National Police announced the arrest of Pepijn van der Stap, another alleged member of ShinyHunters.

    Reported ContestedView cited source
  22. [22]

    The FBI took down much of the group's infrastructure over the last two weeks, and law enforcement has stymied efforts to restore its platforms.

    Reported ContestedView cited source

Sources

14 independent publishers whose own reporting we read for this story.

  1. abcnews.com

    1 article · October 9, 2026

    Suspect arrested in FBI hack that exposed employee information - ABC News
  2. bleepingcomputer.com

    2 articles · October 10, 2026

    FBI arrests another suspected ShinyHunters hacker after agency breach
  3. cbsnews.com

    1 article · October 9, 2026

    FBI arrests suspected member of ShinyHunters in connection with breach of bureau's jobs website - CBS News
  4. cyberscoop.com

    1 article · October 10, 2026

    Canadian cybersecurity executive arrested in federal extortion case
  5. foxnews.com

    1 article · October 9, 2026

    FBI arrests another ShinyHunters suspect in FBIjobs.gov data breach | Fox News
  6. gizmodo.com

    1 article · October 11, 2026

    Cyber Extortion Expert Charged With Cyber Extortion Amid FBI Website Hack Manhunt
  7. hackread.com

    1 article · October 10, 2026

    FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
  8. infosecurity-magazine.com

    1 article · October 12, 2026

    Net Closes Around ShinyHunters with Another FBI Arrest
  9. krebsonsecurity.com

    1 article · October 9, 2026

    FBI Arrests Founder of Ransomware Negotiation Firm
  10. nextgov.com

    2 articles · October 10, 2026

    FBI arrests another ShinyHunters suspect after massive breach of employee data - Nextgov/FCW
  11. securityaffairs.com

    1 article · October 12, 2026

    ShinyHunters arrest number three: a Canadian ransomware negotiator
  12. securityweek.com

    1 article · October 12, 2026

    Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
  13. thehackernews.com

    1 article · October 9, 2026

    FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
  14. therecord.media

    1 article · October 9, 2026

    FBI touts another ShinyHunters arrest in response to data breach

Topics and entities

Topics

Entities