The FBI and Dutch National Police have jointly arrested a suspected member of the ShinyHunters cybercrime group, ending a hunt that began after the hackers claimed responsibility for defacing the FBI’s employment portal and stealing sensitive personnel data.
The arrest took place on Tuesday, just one week after the group boasted about compromising FBI systems. During a press conference, FBI Director Kash Patel described the detained individual as “one of the alleged leaders” of the organization, though he declined to release specific identifying details.
“As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” Patel stated on the social media platform X.
In a separate statement, the FBI confirmed it is conducting continuous investigations into the cybersecurity incident involving FBIJobs.gov. The agency emphasized that it has maintained regular communication with potentially affected individuals and issued multiple Bureau-wide notifications within 24 hours of the breach becoming public.
The ShinyHunters group initially claimed in late September that they had exfiltrated between two and three terabytes of data related to FBI and Justice Department employees. According to the hackers, the intrusion was facilitated by a previously unknown vulnerability in Oracle PeopleSoft, a widely used human resources management platform.
In communications posted on the dark web and shared with various media outlets, the cybercriminals addressed both Patel and FBI Cyber Division Assistant Director Brett Leatherman, declaring, “We have compromised the FBI.” The group further alleged that they possessed confidential information regarding nearly all active FBI agents and job applicants, specifically naming criminal justice, human resources, and Medlink systems as targets.
On Monday, The New York Times reported that FBI staff received an internal email classifying the event as a cybersecurity incident and acknowledging that personal information of some employees had been stolen. CBS News has not independently verified the contents of that memorandum.
Only one arrest so far? I wonder how many other leaders are still operating from safe havens overseas.
Oracle PeopleSoft vulnerability again? Why does the government always use legacy systems for sensitive data?
Wait, they stole terabytes of agent data? I hope everyone’s identity is being protected right now.
This is huge news. ShinyHunters targeting the FBI directly shows how brazen these groups have become.