INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Arrests ShinyHunters Suspect Involved in Jobs Portal Data Breach

| 2026-10-09 15:41 CRITICAL MEDIUM RANSOMWARE & EXTORTION DATA BREACH LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
The FBI arrested a 24-year-old Canadian citizen, identified as Pepijn van der Stap in the Netherlands and Saif al-Din Khader in Jordan, on suspicion of involvement in the theft of sensitive data from the FBI's jobs portal. The breach was announced by ShinyHunters earlier this year, with reports emerging that almost all FBI agents and job applicants had their personal information stolen. According to the FBI, the suspect is believed to be one of the group's alleged leaders, arrested under Dutch law with FBI support in September 15. Khader, detained in Jordan, is cooperating with the FBI, but it is unclear how his arrest resulted from that cooperation. The current status indicates that these arrests are part of an ongoing effort by the FBI and its partners to disrupt ShinyHunters and their associates, who remain at large despite multiple arrests made public since September.
Technical Mitigations AI-generated
• Pre-compromise (ATT&CK mitigation for Botnet): This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters UmbreonUmbreon
Target & Sectors
NORTH_AMERICA NORTH_AMERICA BENELUX BENELUX governmentgovernment technologytechnology
Incident Timeline
‎2025/10/09
The FBI alleges that ShinyHunters breached more than 140 organizations and took at least $70 million in extortion payments since last year.
attribution FBI
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
tactic Extortion
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
victims 140 organizations
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
financial $70 organizations
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
‎October 2025
Threat actors exploited a vulnerability in the Defense Manpower Data Center's file-sharing system for nearly nine months, from October 2025 until July 16, 2026.
target_region United States
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
organisation Defense Manpower Data Center
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
organisation Pentagon
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
general_metric 2.8 living people
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
general_metric 294,000 deceased people
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
‎the start of 2025
The FBI made another arrest of a ShinyHunter, but this incident occurred in response to an unspecified data breach.
source_region United States
But it does make me wonder about all the budgetary cuts that have happened to US cyber defense since the start of 2025.
‎July 2026
Threat actors exploited a vulnerability in an unnamed file-sharing system for approximately nine months, from October 2025 to July 2026.
‎this past July 16
Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until July 16.
target_region United States
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
organisation Defense Manpower Data Center
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
organisation Pentagon
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
general_metric 2.8 living people
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
general_metric 294,000 deceased people
Also discussed on this episode: Hackers gained access to a reportedly unencrypted Defense Manpower Data Center file-sharing system for roughly nine months, from October 2025 until this past July 16, exposing Pentagon records on nearly 2.8 million living people and 294,000 deceased people tied to the US military; and the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a hack invol…
‎2026/09/09
The FBI cooperated with Dutch authorities to arrest a suspected ShinyHunter member last month.
attribution FBI
The FBI has responded aggressively to this recent incident involving the bureau, cooperating with Dutch authorities to arrest another suspected member of the gang last month .
target_region Netherlands
The FBI has responded aggressively to this recent incident involving the bureau, cooperating with Dutch authorities to arrest another suspected member of the gang last month .
‎September 15
The FBI announced the arrest of a 24-year-old Amsterdam man in response to a data breach attributed to ShinyHunters.
attribution FBI
" Where When Made public by Suspect Netherlands September 15 Dutch police and the FBI A 24-year-old Amsterdam man.
source_region Netherlands
" Where When Made public by Suspect Netherlands September 15 Dutch police and the FBI A 24-year-old Amsterdam man.
‎September 22
The man arrested in the Netherlands a week before September 22 was taken into custody by authorities.
attribution FBI
The man arrested in the Netherlands was taken into custody a week before ShinyHunters announced the FBI breach on September 22.
threat_actor ShinyHunters
The man arrested in the Netherlands was taken into custody a week before ShinyHunters announced the FBI breach on September 22.
source_region Netherlands
The man arrested in the Netherlands was taken into custody a week before ShinyHunters announced the FBI breach on September 22.
‎September 28
Saif al-Din Khader was arrested in Jordan on September 28.
source_region Jordan
Multiple FBI sources told Reuters on Saturday that Saif ‌al-Din Khader was arrested in Jordan on September 28 after previously being identified by journalists and researchers as a key member of the group.
attribution FBI
Multiple FBI sources told Reuters on Saturday that Saif ‌al-Din Khader was arrested in Jordan on September 28 after previously being identified by journalists and researchers as a key member of the group.
organisation Reuters
Multiple FBI sources told Reuters on Saturday that Saif ‌al-Din Khader was arrested in Jordan on September 28 after previously being identified by journalists and researchers as a key member of the group.
‎September 29
The FBI announced the arrest of a ShinyHunter suspect in response to a data breach, according to Reuters' unnamed sources.
target_region Jordan
Jordan September 29, according to Reuters' sources Reuters, citing unnamed sources.
‎2026/10/02
The FBI arrested a ShinyHunter suspect in response to a data breach, following an internal memo sent to employees last week warning them of the potential danger.
‎October 3
The FBI announced the arrest of multiple ShinyHunters suspects in response to a data breach.
attribution FBI
The FBI said in a statement Reuters reported on October 3 that it had "already worked with partners to arrest multiple subjects.
‎October 5
A contractor failed to implement a security patch explicitly issued by the FBI's Cyber Division, allowing an unspecified threat actor to breach the platform.
attribution FBI
It happened after "a contractor failed to implement a security patch explicitly issued to secure the platform," Brett Leatherman, assistant director of the FBI's Cyber Division, told Reuters on October 5.
organisation Cyber Division
It happened after "a contractor failed to implement a security patch explicitly issued to secure the platform," Brett Leatherman, assistant director of the FBI's Cyber Division, told Reuters on October 5.
‎October 9
The FBI arrested a suspected co-conspirator of ShinyHunters, according to an announcement by FBI Director Kash Patel on October 9.
attribution FBI
 Swati Khandelwal  Oct 09, 2026 Cybercrime / Data Breach The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X .
tactic Data Breach
 Swati Khandelwal  Oct 09, 2026 Cybercrime / Data Breach The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X .
threat_actor ShinyHunters
 Swati Khandelwal  Oct 09, 2026 Cybercrime / Data Breach The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X .
organisation Cybercrime / Data Breach
 Swati Khandelwal  Oct 09, 2026 Cybercrime / Data Breach The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X .
general_metric 09  Oct
 Swati Khandelwal  Oct 09, 2026 Cybercrime / Data Breach The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X .
‎Oct 09, 2026
The FBI announced the arrest of a ShinyHunter suspect in connection with a data breach.
industry Government
General Document Context
‎2026/10/09
ShinyHunters allegedly breached the FBI through a vulnerability in Oracle software, and later cooperated with Jordanian authorities to help locate other members of the group.
organisation Reuters
Earlier Arrests in the Netherlands and Jordan Reuters counts the new arrest as the third made public since news of the breach broke in late September.
Earlier this month, Jordanian authorities detained a suspected member of ShinyHunters; as first reported by Reuters, the alleged member is apparently cooperating with officials.
organisation Khader
Khader, the suspect detained in Jordan , is cooperating with the FBI, according to Reuters, which cited people familiar with the matter.
threat_actor ShinyHunters
FBI touts another ShinyHunters arrest in response to data breach.
The FBI arrested another person allegedly connected to the ShinyHunters cybercriminal organization this week as the bureau seeks to detain those responsible for a recent breach of its jobs site.
On Friday morning, FBI Director Kash Patel released a statement saying agents “arrested another suspected co-conspirator of the ShinyHunters group” in an operation conducted earlier this week.
At least two other suspected ShinyHunters members have been detained over the last two weeks after the group took over the FBIjobs.gov domain, defaced it and stole troves of sensitive data on nearly every employee at the FBI.
Khader allegedly agreed to cooperate with the FBI and other law enforcement agencies to help locate other members of ShinyHunters.
That arrest came after the FBI and the Dutch National Police announced the arrest of Pepijn van der Stap — another alleged member of ShinyHunters.
ShinyHunters told several news outlets in messages that it would not release the stolen information and did not want to escalate the feud with the FBI — which they said started because of an advisory about their actions that they disagreed with.
After ShinyHunters claimed a breach against the FBI and defaced its website, a suspected member of the cybercrime gang was detained in Jordan.
What We Missed: FBI Strikes Back at ShinyHunters.
In this episode of "What We Missed," Dark Reading's Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn't make it into the publication, starting with ShinyHunters ' supposed breach against the FBI.
FBI versus ShinyHunters, back and forth.
But basically, ShinyHunters claimed to have breached the FBI.
I guess the motive here is that the ShinyHunters members were upset with the way they were being portrayed by the FBI.
And the reason why I connected this to the FBI case, even though they haven't been publicly connected, is I'm like, what if ShinyHunters attacked this data center too?
ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants.
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack.
" Patel also wrote that the FBI will keep working with its partners "to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate."
What Was Stolen and How the FBI Says It Happened A sample of the data that ShinyHunters shared contained extensive personal information on FBI employees, details of sensitive job roles, and psychiatric and medical information, a Reuters analysis found.
ShinyHunters said it targeted the FBI over an advisory from May that it says makes false claims about the group.
ShinyHunters trades financial extortion for a reckless war of ego with the FBI.
Threat hunters and researchers are alarmed by what they’ve seen in data ShinyHunters claims it stole from the FBI .
The FBI jobs site, which was temporarily defaced by ShinyHunters, remains offline as of Monday.
The FBI hasn’t confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly.
Stolen data puts FBI agents at serious risk While the full scope of the attack remains under investigation, cybercrime experts are startled by the potential counterintelligence exposure and safety risks lurking in data ShinyHunters has shared with journalists in a bid to bolster its claims and mount public pressure on the FBI.
It is a whole different ball game when you do not know the identity of the person you are investigating, but they know exactly who you are.” Cynthia Kaiser, a former FBI official, noted that some of the data ShinyHunters stole from the FBI has already been distributed widely beyond control.
ShinyHunters said it wants the FBI to remove or amend the public service announcement, and set a Monday deadline for the agency to take action.
Often it’s for clout and bragging rights or a personal vendetta, which I believe is the case here.” ShinyHunters’ public attempt to extort the FBI marks a major point of escalation riding on a rare motive.
Earlier this month, Jordanian authorities detained a suspected member of ShinyHunters; as first reported by Reuters, the alleged member is apparently cooperating with officials.
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
More recently, there was allegedly a ShinyHunters hacker who was detained in Jordan, of all places.
Related: Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts ShinyHunters, a loose collective of financially motivated threat actors, has claimed a swath of attacks in recent months against entities including ReliaQuest , Instructure , and even fellow threat group Cl0p .
And first up, Alex, our old friends at ShinyHunters , back again.
And I believe there was another hacker that was also arrested recently that was connected to ShinyHunters, arrested by the Dutch National Police a couple of weeks ago.
I think it's interesting, and it seems like there's some validity to the ShinyHunters claim.
I thought maybe this was connected to ShinyHunters or another Com-adjacent group.
The advisory describes ShinyHunters as a cybercriminal group that specializes in large-scale data breaches and extortion.
It calls ShinyHunters "the group believed to be responsible for the recent FBIjobs.gov incident.
ShinyHunters told The Hacker News that he has no association with the group.
…way to verify all data was deleted, and the FBI has said that whenever it gets onto ransomware group infrastructure, it finds data that the group promised would be deleted.” Experts dumbfounded by ShinyHunters’ claimed objective ShinyHunters said it targeted the FBI and stole sensitive data to refute details the agency shared in a public service announcement it issued in May about the grou…
“They need to walk away from the issue and leave this data alone.” ‘This one’s personal’ ShinyHunters typically engages in cybercrime for financial extortion.
The sample data ShinyHunters shared with journalists was available on its internal forum, granting anyone with access the ability to pass the information on to others, she wrote in a LinkedIn post .
Researchers are dumbfounded by ShinyHunters’ coercive action.
Various cybercriminals have been tied to activity attributed to the ShinyHunters name.
The difference is the damage it can cause to the organization and the people who are supposed to prevent and prosecute criminals like ShinyHunters,” DiMaggio said.
organisation Pepijn
That arrest came after the FBI and the Dutch National Police announced the arrest of Pepijn van der Stap — another alleged member of ShinyHunters.
Identified to Reuters and CBS News as Pepijn van der Stap.
organisation Brett Leatherman
They put out a video where Brett Leatherman, assistant director of the FBI's cyber division, basically said, "Hey, if you do this again, you're gonna be in real trouble" in so many words — the video is really interesting, and I think on one hand it's good that the authorities are taking a hard line and going after these guys.
organisation Times
The Times reported that the arrest was made on suspicion of involvement in the theft of FBI data.
organisation The Hacker News
ShinyHunters told The Hacker News that he has no association with the group.
organisation The New York Times
The New York Times reported that the arrest was conducted in Pennsylvania and involved a Canadian national.
organisation Telegram
The group moved its operations back to Telegram this week but posted a message in one group on Friday morning saying it no longer planned to remain on the platform.
organisation Microsoft Disrupts
Related: Microsoft Disrupts EvilTokens Device Code Phishing Service DR's Alex Culafi:
organisation Dark Reading
For all of our Dark Reading news videos, please check out our YouTube channel and our curated video articles .
organisation YouTube
For all of our Dark Reading news videos, please check out our YouTube channel and our curated video articles .
organisation Informa TechTarget's
What We Missed With Rob Wright & Alex Culafi: Full Transcript This transcript has been edited for clarity and length by Informa TechTarget's internal AI assistant.
organisation Credential Theft
Related: AI Model Evaluator METR Hit by Credential Theft, Probing DR's Rob Wright:
organisation Social Security
The exposed information varied, but included Social Security numbers, names, birth dates, contact information, race, sex, and military occupational information.
organisation Department of Defense
So regardless of who did it — the government, the Pentagon, Department of Defense , I'm not gonna call it the other thing — I just think it’s a horrible look.
organisation DVID
So this agentic AI attack got in there, got some data, got some employee data from this organization, which DVID is a good organization that's done a lot of interesting research over the years.
organisation OpenAI
DR's Rob Wright: I think it's unclear at this point, but yeah, you're not off-base to ask that question because we keep seeing information about other OpenAI agents or Anthropic agents probing or trying to hack other websites.
organisation CBS News
The suspect is a Canadian citizen who was arrested in Pennsylvania, according to The New York Times and CBS News .
organisation PeopleSoft
Two sources told Reuters they are PeopleSoft, Oracle's human resources software, and Accenture.
organisation Oracle
Two sources told Reuters they are PeopleSoft, Oracle's human resources software, and Accenture.
organisation Screenshots
Screenshots, downloads, emails — once data is disseminated, you can’t pull it back and delete all copies,” wrote Kaiser, now a senior vice president at Halcyon’s ransomware research center.
organisation Kaiser
Screenshots, downloads, emails — once data is disseminated, you can’t pull it back and delete all copies,” wrote Kaiser, now a senior vice president at Halcyon’s ransomware research center.
organisation Halcyon’s
Screenshots, downloads, emails — once data is disseminated, you can’t pull it back and delete all copies,” wrote Kaiser, now a senior vice president at Halcyon’s ransomware research center.
organisation CyberScoop
“I am gravely concerned about the implications it opens up,” a researcher who has viewed and studied a sample of the data told CyberScoop.
organisation Arkem Cyber
That creates risk for personnel and could put sources or investigations connected to their work at risk,” said Jon DiMaggio, principal researcher at Arkem Cyber.
‎the first half of 2026
The FBI announced the arrest of a ShinyHunter suspect in response to a data breach targeting government agencies and healthcare organizations.
industry Government
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
industry Healthcare
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
attribution Omdia
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
general_metric 15 %
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
general_metric 21 %
Government agencies and associated organizations are a common target for cyberattacks, accounting for 15% of all global breaches in the first half of 2026, second only to healthcare at 21%, according to Omdia.
Tactical Metrics
Metrics
victims
140
Organizations
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
Metrics
financial
70,000,000
Financial Impact / Stolen Funds
The FBI alleges that the group has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.
Intelligence Sources
CyberScoop 2026-09-28
Dark Reading 2026-10-09
TheRecord 2026-10-09
The Hacker News 2026-10-09