FBI announces another arrest tied to the hack of its jobs portal
Kash Patel gave no name or charges. It is the third public arrest in the ShinyHunters case, and the risk for exposed staff remains the same.
FBI Director Kash Patel announced on X on Oct. 9 the arrest of "another suspected accomplice" of ShinyHunters, the extortion group the bureau blames for the theft of data from its jobs portal, according to CBS News. The arrest took place in recent days, and the bureau did not say who the person is or what he is charged with.
The New York Times, cited by The Record and BleepingComputer, says he is a Canadian citizen arrested in Pennsylvania. That information comes from anonymous sources and the FBI has not confirmed it. A police source told CBS he is believed to be directly involved in the hack, and that other suspected accomplices remain free.
It is the third public arrest since the intrusion came to light. Earlier ones took place in the Netherlands and Jordan, according to Reuters, cited by the outlets consulted.
Patel said it is the latest of the arrests "in a matter of days" linked to this network. He did not say what role the detainee played in the intrusion.
What the FBI blames on a contractor
Brett Leatherman of the FBI's Cyber Division said a review found that a contractor did not install a security patch on the system that was attacked, according to CBS. The bureau removed an Accenture contractor. BleepingComputer adds that the group said it used a zero-day, a flaw with no patch yet, in Oracle PeopleSoft; that version comes from the attackers, not the FBI.
What is known about the data
ShinyHunters claims it stole 2 to 3 terabytes of data on current and former staff, applicants and internal files. The samples BleepingComputer saw included relatives' details, home addresses, Social Security numbers and job assignments. There is no official count of those affected: all of this is the group's claim.
According to The Record, thousands of records of local police officers who work with the bureau are among what was taken. BleepingComputer adds that the FBI sent an internal memo that assumed all of its staff were affected.
The section already reported that the group said it would not publish the data. An arrest does not bring the data back: the detainee's identity and charges, and how many people are affected, remain to be clarified.
