FBI arrests another ShinyHunters suspect after massive breach of employee data
Federal Bureau of Investigation Director Kash Patel looks on during a news conference at the Robert F. Kennedy Department of Justice building on August 05, 2026 in Washington, DC. Anna Moneymaker/Getty Images
The arrest follows action against suspected members in Jordan and the Netherlands as the bureau investigates the theft of its sensitive personnel information.
The FBI has arrested another suspected member of ShinyHunters, the hacking group believed to be responsible for a breach that exposed sensitive information about bureau employees, Director Kash Patel said Friday.
The New York Times first reported the arrest, identifying the suspect as a Canadian man taken into custody in Pennsylvania, according to two sources who spoke to the newspaper.
“Earlier this week, our agents in the field arrested another suspected co-conspirator of the ShinyHunters group — the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” Patel said in a statement.
The statement did not name the suspect, specify charges or describe the person’s alleged role in the intrusion.
“This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly,” Patel said.
The announcement follows Reuters reporting that suspected ShinyHunters member Saif al-Din Khader was detained in Jordan and was cooperating with investigators. Two sources told the news agency that Khader was helping the FBI and other law enforcement agencies locate fellow hackers.
Dutch authorities also arrested an alleged leader of the group, an action the FBI announced Sept. 29. At the time, FBI cyber chief Brett Leatherman said that suspect and his alleged co-conspirators had breached more than 140 organizations and collected at least $70 million in extortion payments since last year.
The arrests come as the bureau confronts the consequences of a breach involving employees’ personal information and details about sensitive assignments. ShinyHunters supplied Nextgov/FCW with an apparent sample containing roughly 5,000 entries, including names, home addresses, phone numbers and information about relatives. The records also identified personnel in intelligence and surveillance roles, as previously reported.
The FBI has blamed a missed security update for the intrusion. Nextgov/FCW and Reuters reported this week that the bureau removed a contractor working for Accenture in response to the intrusion.
ShinyHunters has said it would not publish the stolen FBI data, but the information could still be sold to foreign intelligence services or other buyers later on.
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate,” Patel said.