Identity · Threat Intelligence
FBI arrests suspected ShinyHunters hacker after major data breach
The FBI has arrested a suspected member of the ShinyHunters group, believed to be behind a breach of the bureau's jobs website that exposed sensitive employee data.
Ross Grant3 min read
The short version
The FBI arrested a suspected hacker linked to a group called ShinyHunters. This group broke into the FBI's jobs website and stole sensitive information about employees and job applicants. The breach happened because a software flaw was not fixed. The FBI is still investigating and warning those affected to be careful.
By the numbers
- 2–3TBAmount of data stolen in the breach (claimed by attackers)BleepingComputer
- Nearly all FBI employeesEstimated number of people whose data was exposedBleepingComputer
- September 2026Month the breach was first reportedCBS News
- 3Suspected ShinyHunters members arrested in recent weeksRecorded Future News
What happened?
The FBI has arrested a suspected member of the ShinyHunters hacking group, believed to be involved in the recent breach of the bureau's jobs website. The breach exposed sensitive data on nearly every FBI employee and job applicant. The arrest took place in Pennsylvania and involved a Canadian national, according to multiple news outlets.
Arrest follows breach of FBI jobs website
The FBI has arrested a suspected member of the ShinyHunters hacking group, which claimed responsibility for a recent breach of the bureau's jobs website. The arrest took place in Pennsylvania and involved a Canadian national, according to several news outlets. The FBI has not released the suspect's name or further details about the charges. This is the latest in a series of arrests linked to ShinyHunters, as law enforcement agencies worldwide step up efforts to dismantle the group.Recorded Future News (opens in a new tab) CBS News (opens in a new tab) BleepingComputer (opens in a new tab).
What was stolen and who is affected?
The breach, first reported in September, targeted the FBI's jobs portal. ShinyHunters claimed to have stolen between 2 and 3 terabytes of data, including sensitive information on nearly every FBI employee and job applicant. Data samples shared with media outlets showed that the stolen information included home addresses, phone numbers, Social Security numbers, medical and psychiatric records, and details about employees' families and job assignments. Records about local police officers working with the FBI were also exposed. An internal FBI memo reportedly warned staff that the breach could affect all employees.BleepingComputer (opens in a new tab).
How did the attack happen?
According to the FBI and news reports, the breach was made possible by a vulnerability in Oracle PeopleSoft, a human resources management system. The system was managed by a third-party contractor, Accenture, which failed to apply a security patch. The contractor has since been fired. ShinyHunters allegedly exploited the unpatched vulnerability to gain access to the jobs portal, then moved laterally to access sensitive data stored in the FBI's cloud infrastructure. The group shared samples of the stolen data to prove the breach.Recorded Future News (opens in a new tab) CBS News (opens in a new tab).
What has the FBI done in response?
The FBI has responded by arresting several suspected members of ShinyHunters in the US, Jordan, and the Netherlands. The bureau has also taken down much of the group's online infrastructure and warned employees about the risks to themselves and their families. The FBI says it is working with international partners to disrupt the group further. ShinyHunters told reporters it did not intend to release the stolen data and claimed the attack was a response to an FBI advisory about the group. However, the breach has already put thousands of people at risk of identity theft and other harms.Recorded Future News (opens in a new tab) BleepingComputer (opens in a new tab).
What happens next and what should affected people do?
The FBI continues to investigate and pursue other members of ShinyHunters. Employees and others whose data may have been exposed should be alert for signs of identity theft, phishing attempts, or other suspicious activity. Since the breach involved highly sensitive personal information, those affected may want to consider credit monitoring and take steps to protect their online accounts. The full impact of the breach is still being assessed, and more details may emerge as the investigation continues.
Claimed vs confirmed
- Confirmed
ShinyHunters stole 2–3TB of sensitive FBI employee data.
Attackers shared data samples with media outlets, and the FBI warned staff of the breach.
- Confirmed
The breach was caused by an unpatched Oracle PeopleSoft vulnerability.
The FBI and news outlets reported the contractor failed to apply a security patch.
- Unconfirmed
ShinyHunters will not release the stolen data.
The group told media they do not plan to leak the data, but this cannot be independently verified.
The impact
- Money
- The FBI may face costs for investigation, response, and support for affected employees. Under US law, government agencies are required to notify affected individuals when sensitive data is breached.
- Reputation
- The breach is being compared to the 2015 Office of Personnel Management hack and may damage trust in the FBI's ability to protect sensitive data.
- Customers
- FBI employees, job applicants, and local police officers are at risk of identity theft and targeted attacks. They should monitor accounts and be alert for scams.
Why it matters
This breach exposed highly sensitive personal information about FBI employees, job applicants, and local police officers. Such data can be used for identity theft or to target individuals for further attacks. It also highlights the risks of unpatched software and the importance of strong security practices, even for major government agencies.
How does it work?
Attackers exploited an unpatched vulnerability in Oracle PeopleSoft, a human resources management system. The system was managed by a third-party contractor who failed to apply a security patch. This allowed the hackers to access the FBI's jobs portal and steal sensitive data.
Key points
- FBI arrested a suspected ShinyHunters hacker after a major data breach.
- Hackers exploited an unpatched vulnerability in a third-party system.
- Sensitive data on FBI employees and job applicants was exposed.
- The breach highlights the risks of poor patch management.
- Law enforcement is actively pursuing members of the hacking group.
Sources
Recorded Future News
Reference
CBS News
Reference
BleepingComputer
Reference
Dark Reading
Reference
The Hacker News
Reference
