Second ShinyHunters suspect taken into custody over FBI intrusion
The FBI has detained another suspected participant in the ShinyHunters extortion crew in connection with a recent intrusion into bureau systems, according to Director Kash Patel. A report identified the person as a Canadian citizen taken into custody in Pennsylvania, though authorities have not released a name or charges. The group has claimed it exploited an Oracle PeopleSoft zero-day and moved into FBI-managed AWS GovCloud, stealing terabytes of employee and applicant data.
Director Kash Patel said agents detained another alleged ShinyHunters co-conspirator tied to the FBIJobs.gov intrusion, which he said involved a third-party-managed platform. The New York Times identified the suspect as a Canadian citizen arrested in Pennsylvania and described as a central alleged accomplice; no name or charges were released.
The group has claimed it used an Oracle PeopleSoft zero-day to reach FBI-managed AWS GovCloud and take 2TB–3TB of data, including employee, applicant, medical, psychiatric, and internal records. Earlier, Dutch police arrested Pepijn van der Stap, while Jordan reportedly detained Saif al-Din Khader; ShinyHunters denied van der Stap’s involvement.
The alleged breach could affect current and former FBI personnel, applicants, and their families, whose addresses, Social Security numbers, medical, psychiatric, and assignment details may have been exposed. That may heighten identity-theft, harassment, or targeting risks, while eroding confidence in third-party systems handling sensitive government data. The arrests could disrupt ShinyHunters’ operations and encourage cooperation, but they may not reduce harm already caused by leaked records or prevent copycat extortion attempts.