FBI Closes In on ShinyHunters as Third Arrest Made in Massive Agency Breach
Finn's Take· TL;DR- FBI arrests third ShinyHunters member in Canada as international crackdown on hacking group accelerates across multiple countries.
- ShinyHunters stole 2-3TB of FBI data including employee names, addresses, SSNs from jobs portal due to contractor's failure to patch security vulnerability.
- Arrested members span US, Netherlands, and Jordan; FBI Director Patel vows relentless pursuit to dismantle remaining group members and associates worldwide.
A Hacking Group That Targeted the FBI Is Now Being Dismantled One Arrest at a Time
When hackers brazenly claim to have breached the FBI itself, the bureau tends to respond with urgency. That urgency is now showing results. FBI Director Kash Patel announced on October 9 that agents arrested another suspected co-conspirator linked to the ShinyHunters hacking group, the latest development in the bureau's investigation of a cybersecurity incident involving its jobs website. The arrest signals that a global crackdown on one of the world's most active cybercriminal networks is accelerating fast.
It is the third publicly announced arrest since news of the breach broke in late September. The newest suspect is a Canadian citizen who was arrested in Pennsylvania, according to The New York Times and CBS News, both citing unnamed sources. Authorities have not publicly disclosed the suspect's name or the specific charges against him.
What ShinyHunters Stole — and How They Got In
On September 22, 2026, ShinyHunters claimed to have breached the FBI's jobs portal and stolen names, home addresses, and phone numbers for thousands of agents and their spouses. The scope of the alleged theft is staggering. The threat actors claimed they stole between 2TB and 3TB of data, including information on current and former FBI employees, job applicants, medical and psychiatric records, and internal service records.
ShinyHunters provided journalists with a spreadsheet containing about 5,000 alleged FBI personnel records. Reuters reported that the spreadsheet included names, home addresses, phone numbers, dates of birth, Social Security numbers, and emergency contact information — and in some cases, sensitive intelligence or counterespionage work details. As for how the hackers got in, the FBI's review found that the breach resulted from a security failure on a platform managed by an outside organization, after "a contractor failed to implement a security patch explicitly issued to secure the platform," according to Brett Leatherman, assistant director of the FBI's Cyber Division. The FBI subsequently removed the contracting company it said was primarily responsible for the breach.
A Global Dragnet Closing In
The arrests span multiple countries, underscoring the international reach of both the hacking group and the law enforcement response. Dutch authorities earlier announced the arrest of a man identified to Reuters as Pepijn van der Stap, who had previously served a sentence for data theft. Reuters also reported the arrest of Saif al-Din Khader, a teenager in Jordan who was alleged to be a key ShinyHunters member. Sources said he is helping the FBI and global law enforcement track down the remaining cell members.
ShinyHunters says retaliation, rather than a demand for money, motivated the attack — pointing to warnings the FBI itself had issued about ShinyHunters-related cyber activity earlier in 2026. Whether that claim holds up legally is another matter entirely. After initially saying they would post the sensitive information publicly, the group told reporters they had recanted the threat.
The FBI's Message Is Clear
Patel stated that this is "the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly." The pace of arrests is deliberate and pointed. Patel added, "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate."
ShinyHunters is no ordinary group of opportunists. It has been tied to a string of high-profile breaches in 2026 alone. The FBI breach, however, may prove to be the group's most consequential miscalculation — attacking the very agency with the resources and motivation to hunt them down relentlessly. With arrests now spanning the United States, the Netherlands, and Jordan, the net is tightening. The question is no longer whether the group will be dismantled, but how many members will be in custody before it's over.