ShinyHunters: FBI arrests another suspected co-conspirator in the FBIJobs.gov breach; the New York Times says he is a Canadian citizen held in Pennsylvania and seen as a primary co-conspirator
FBI Director Kash Patel said on X on 9 October 2026 that agents had arrested another suspected co-conspirator of the ShinyHunters extortion group, which the bureau blames for the recent FBIJobs.gov incident on a platform run by a third-party vendor. Patel called it the latest of several arrests in a matter of days but did not name the suspect or say where the arrest happened. The New York Times reported that the suspect is a Canadian citizen arrested in Pennsylvania and regarded as a primary co-conspirator in the intrusion; no name or charges have been made public. ShinyHunters told BleepingComputer in September that it got in through an alleged Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud systems, claiming 2 to 3 TB of data on current and former staff and job applicants; the FBI has since said a contractor-managed platform had not installed a security update, and the Times reports an internal memo assumed every employee was affected. Earlier actions: Dutch police arrested Pepijn van der Stap ('Umbreon') on 15 September, and Jordan detained Saif al-Din Khader ('Rey'), who sources say is cooperating with the FBI. Primary: FBI Director Patel on X; wire: BleepingComputer.
- Product
- ShinyHunters / Scattered Lapsus$ Hunters extortion group (FBIJobs.gov third-party platform breach)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- Nothing to patch from the arrest. Keep Oracle PeopleSoft and other internet-facing HR and recruitment platforms on current patches, require your vendors to show patch status for platforms they run for you, and watch ShinyHunters leak channels for your organisation and suppliers.
Primary: FBI Director Kash Patel on X — another suspected ShinyHunters co-conspirator arrested (9 Oct 2026) · Vendor: BleepingComputer — FBI arrests another suspected ShinyHunters hacker after agency breach (9 Oct 2026; cites New York Times) · Cyberstack — related card: Jordan detains alleged ShinyHunters member 'Rey'