FBI Director Kash Patel announced Friday that agents had arrested another suspected co-conspirator of ShinyHunters, the group he said is believed to be responsible for the recent FBIjobs.gov incident.
Patel said in a post on X that the incident occurred on a platform managed by a third-party vendor. "This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," he said.
Patel did not identify the suspect or disclose where the arrest occurred, but The New York Times reports that the individual is a Canadian citizen arrested in Pennsylvania and is considered a primary co-conspirator in the intrusion. Authorities have not publicly disclosed the suspect's name or the specific charges against him.
The arrest is the latest in a series of law enforcement actions since ShinyHunters breached FBI systems last month. The group told BleepingComputer in September that it accessed the systems by exploiting an alleged Oracle PeopleSoft zero-day vulnerability before moving laterally into FBI-managed AWS GovCloud infrastructure.
The threat actors claimed to have stolen between 2TB and 3TB of data, including information on current and former FBI employees, job applicants, medical and psychiatric records, and internal service records. Data samples shared with media outlets confirmed the exposure of home addresses, Social Security numbers, sensitive job assignments, information about employees' family members, and other personal data. The New York Times reported that an internal FBI memo said the agency assumed the breach had affected all employees.
The FBI has since said the incident stemmed from a third-party contractor-managed platform that failed to install a security update.
On September 15, Dutch police arrested Pepijn van der Stap, a 24-year-old Amsterdam man previously known online as "Umbreon," as part of the investigation. ShinyHunters denied that van der Stap was associated with the group, telling BleepingComputer: "That individual has no association with us. Frankly, we are laughing."
Soon afterward, the FBI publicly warned ShinyHunters members to turn themselves in, saying investigators were continuing to identify people involved with the group.