The FBI arrested a Canadian citizen in Pennsylvania on Friday in connection with the hack of its jobs portal by the cybercriminal group ShinyHunters, Director Kash Patel confirmed. The suspect is the latest individual detained in a series of arrests targeting the group, which claimed responsibility for the breach in September.
The hack exposed personal data of nearly all FBI employees, including their identities and those of their spouses, according to the FBI and cybersecurity experts. The breach occurred through a vulnerability in Oracle PeopleSoft, a human resources management system used by the bureau. ShinyHunters stated it stole 2 to 3 terabytes of data, including sensitive information typically targeted in extortion schemes.
The FBI did not disclose the suspect’s identity or the charges filed but confirmed the arrest was part of an ongoing investigation. A U.S. official and a law enforcement source, speaking on condition of anonymity, identified the suspect as a Canadian citizen believed to be directly involved in the hack. Other alleged co-conspirators remain at large, the sources said.
The breach has raised concerns about national security risks, including potential extortion, harassment, or swatting attacks against FBI personnel and their families. The incident is being compared to the 2015 Office of Personnel Management hack, which compromised over 22 million government records. The FBI described the breach as occurring on a third-party vendor’s platform, though it did not name the vendor.
ShinyHunters issued a statement criticizing an FBI advisory from May that labeled the group as a cybercriminal organization specializing in data breaches and extortion. The hackers claimed the advisory contained false allegations and accused the FBI of misrepresenting their activities. Experts noted that while the stolen data was typical of breaches, the scope and potential for targeted harassment elevated the threat level.
The FBI’s Cyber Division has been working with domestic and international partners to dismantle ShinyHunters and pursue additional leads. Patel emphasized the bureau’s commitment to disrupting the group’s operations, stating, “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate.”
The arrest follows the FBI’s jobs portal being taken offline after the breach, though the bureau has not specified whether the site has since been restored or secured. Cybersecurity analysts have warned that such breaches could erode public trust in government systems and encourage further attacks on critical infrastructure.