The FBI said on October 9, 2026, that it had arrested another suspected ShinyHunters co-conspirator, this time tying the suspect directly to the breach of the bureau’s own job-applicant portal, FBIJobs.gov. FBI Director Kash Patel announced the arrest after the FBI had publicized, on September 29, 2026, the detention of a separate ShinyHunters-linked suspect in the Netherlands, and by October 17, 2026, public reporting described at least three arrests across three countries connected to the group’s recent campaign. The Record from Recorded Future News and Fox News both covered the October 9 announcement, framing it as the latest in a fast-moving law enforcement push against one of the most prolific data-extortion crews currently operating.
For an agency that spends most of its time investigating hackers rather than being hacked, the FBIJobs.gov incident was an unusually personal embarrassment. ShinyHunters claimed to have stolen records tied to almost every FBI agent and job applicant who used the portal. The bureau’s response, which grew into arrests in the Netherlands, Jordan, and the United States plus a public statement from the director himself, signals how seriously the FBI is treating a breach of its own hiring infrastructure. It also offers a window into how a small, loosely organized hacking collective has managed to outlast years of international law enforcement pressure.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the FBI Announced on October 9
Patel said agents had arrested “another suspected co-conspirator” earlier in the week in connection with the FBIJobs.gov incident, according to Fox News. The bureau did not publicly name the suspect, disclose an exact arrest date, or reveal which agency made the arrest. Reporting cited by Fox News and other outlets described the location as Pennsylvania and the suspect as a Canadian national, though the FBI itself did not confirm those details in its public statement. No criminal complaint or indictment against this suspect had surfaced publicly as of the announcement.
That caution matters. ShinyHunters has burned through a long list of monikers, affiliated personas, and alleged members over the past six years, and not every detained or questioned individual turns out to be formally charged. The appropriate legal label here is suspect or alleged co-conspirator, not convicted hacker, and that distinction is one the FBI itself has been careful to preserve in its public language. It echoes the same caution federal agencies have applied in other recent cases, including the arrest of a core Qilin ransomware member in Japan, where investigators also stopped short of confirming a conviction.
Inside the FBIJobs.gov Breach Claim
The saga traces back to a claim ShinyHunters posted after allegedly compromising the FBI’s employment portal. According to a message attributed to the group and reported by The Associated Press, the hackers wrote: “We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job.” The FBI confirmed it was investigating the claim without validating its full scope. A bureau spokesperson told PBS NewsHour: “The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information.”
Crucially, the FBI has characterized the breach as occurring on a platform managed by a third-party vendor rather than describing it as a direct compromise of the bureau’s internal network, per Fox News. That distinction echoes a pattern seen across dozens of ShinyHunters-linked incidents over the past two years: the group rarely breaks into hardened core systems directly. Instead it goes after the software vendors, contractors, and SaaS integrations that sit one step removed, where credentials are often weaker and monitoring is thinner. The same third-party-access pattern showed up in the Oracle Health breach that exposed records on nearly 20 million people and in the EY breach that touched Goldman Sachs and Man Group client data.
Retired FBI supervisory special agent Jason Pack, now CEO of Media Rep Global Strategies, offered a useful way to size up the severity of the claim. “There is a meaningful difference between somebody obtaining personnel information and somebody gaining access to classified investigative systems,” Pack told Fox News. That framing suggests the exposure, while serious for the employees and applicants involved, has not been shown to extend into the bureau’s sensitive case files or operational systems.
Two Arrests, Two Countries: The September-October Timeline
Coverage of “the ShinyHunters arrest” has blurred together two distinct events that happened roughly ten days apart. The first was publicized on September 29, 2026, when Patel announced that Dutch authorities had detained a suspect in Amsterdam, an arrest Dutch police made on September 15, 2026. The second came on October 9, the Pennsylvania-linked arrest tied specifically to the FBIJobs.gov breach. Here is how the two events line up against each other.
| Detail | September 29 Arrest | October 9 Arrest |
|---|---|---|
| Announced by | FBI Director Kash Patel | FBI Director Kash Patel |
| Arresting authority | Dutch National Police, High-Tech Crime Unit (with FBI assistance) | Not publicly disclosed by the FBI |
| Reported location | Amsterdam, Netherlands | Pennsylvania, United States (per reporting, not FBI-confirmed) |
| Suspect identified | Named in later reporting as a 24-year-old using the alias “Umbreon” | Not publicly named; described in reporting as a Canadian national |
| Breach tied to arrest | Broader ShinyHunters extortion campaign | FBIJobs.gov breach specifically |
| Public charges confirmed | Not publicly detailed in available reporting | Federal extortion-related charges reported against Edward Dubrovsky |
FBI Director Patel struck an upbeat tone after the Netherlands arrest, telling reporters in a statement carried by the BBC: “As we speak, FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest.” Ten days later, the October 9 announcement suggested those leads had already produced a second result.
Who Is the Alleged “Umbreon”
Security researchers and Dutch media, including KrebsOnSecurity, identified the suspect arrested in Amsterdam as a 24-year-old man who used the online alias “Umbreon.” Dutch police arrested him on September 15, 2026, on suspicion of participating in ShinyHunters and a criminal organization, and Dutch authorities said he would remain in pretrial detention for at least 90 days. The Dutch High-Tech Crime Unit carried out the arrest under Dutch law, with the FBI providing investigative assistance, a structure typical of cross-border cybercrime cases where the suspect sits outside direct U.S. jurisdiction. No court filing confirming a formal indictment against this individual had surfaced in available reporting at the time of the October 9 announcement, so his legal status remains that of an arrested suspect rather than a convicted offender.
Brett Leatherman, the assistant director in charge of the FBI’s Cyber Division, used the Netherlands arrest to send a message to the rest of the network. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” Leatherman said, according to NBC News. CBS News separately reported Leatherman’s estimate of the group’s scale: since 2025, the network tied to this suspect and co-conspirators had allegedly breached more than 140 organizations and extracted at least $70 million in extortion payments. That figure, if accurate, would place this single thread of the ShinyHunters ecosystem among the more financially damaging extortion operations tracked by federal investigators this year.
The Unnamed Pennsylvania Suspect
The October 9 case is thinner on confirmed detail. Patel’s public remarks, as carried by Fox News and referenced by The Record, did not include the suspect’s name, exact age, or the specific conduct alleged. Reporting citing people familiar with the investigation described the person as a Canadian national arrested in Pennsylvania, and the New York Times and other outlets later identified him as Edward Dubrovsky, a Canadian cybersecurity executive reportedly arrested on October 8, 2026, but the FBI has not put its own name to those specifics in public statements. The bureau also said it had worked with international partners to arrest multiple subjects connected to the broader incident, without detailing each case individually, a pattern that leaves open the possibility of further undisclosed arrests feeding into the same investigation.
What is consistent across both cases is the FBI’s insistence that the investigation remains active. Patel’s own language, “actively working with partners to obtain and execute more leads,” was used around the first arrest and the tone of the second announcement suggested the same posture holds ten days later. For a network built on the assumption that most members can operate anonymously behind rotating aliases, two arrests in quick succession, even without full public identification, is the kind of pressure meant to be felt internally before it is confirmed externally. It is a similar playbook to the one the bureau used after it tied China-linked hackers to a mailbox-theft campaign and posted a $10 million reward for information leading to an arrest.
ShinyHunters’ Rap Sheet: From 2020 to 2026
ShinyHunters did not appear out of nowhere in 2026. The group is believed to have formed around 2019 and became publicly visible in May 2020, when it began advertising stolen databases and reportedly offered more than 200 million user records for sale within about two weeks of its debut. A U.S. federal indictment later described three individuals connected to the group who targeted more than 60 companies during 2020 and 2021, causing losses described in the millions of dollars, according to a summary of the filing reported by Halcyon. The group’s name has stayed attached to a long run of headline breaches since then, including a Boeing-linked spin-off that KrebsOnSecurity reported was extorted shortly before the 2026 arrests.
| Year | Incident | Reported scale |
|---|---|---|
| 2020-2021 | Multi-sector extortion campaign | More than 60 companies hit; losses in the millions of dollars |
| 2021 | AT&T-linked data sale | Roughly 70 million subscriber records offered for sale |
| 2024 | Snowflake-customer credential abuse (Ticketmaster, AT&T, Santander, Neiman Marcus) | Ticketmaster: 560 million-plus records; AT&T: roughly 109-110 million call records; Santander: 30 million customers; Neiman Marcus: 31 million records |
| 2025 | Salesloft/Drift and Gainsight-linked Salesforce campaigns | Roughly 760 Salesforce organizations cited in one estimate; 200-plus more through Gainsight integrations |
| 2026 | Boeing-linked spin-off extortion | Reported by KrebsOnSecurity; precise victim count not publicly confirmed |
| 2026 | FBIJobs.gov breach claim | Alleged data on almost all FBI agents and job applicants, per the group’s own claim; not independently confirmed by the FBI |
Investigators have repeatedly cautioned that the 2024 Snowflake-linked wave resulted from abuse of stolen contractor credentials and absent multi-factor authentication at customer organizations, not a vulnerability in Snowflake’s own platform. The same caution applies to 2025 and 2026 figures tied to Salesforce, Workday, and other SaaS platforms: these numbers typically describe organizations exposed through stolen OAuth tokens or impersonated help-desk calls, and they are not proof that a single unified ShinyHunters cell personally executed every intrusion.
Inside the Scattered LAPSUS$ Hunters Alliance
Much of the confusion around who did what traces back to the blurry lines separating ShinyHunters from two other well-known crews: Scattered Spider and Lapsus$. Researchers have used the label “Scattered LAPSUS$ Hunters,” sometimes shortened to SLSH, to describe a loose alliance or shared operating ecosystem among the three groups, rather than a single formally structured organization. Threat-intelligence firm Flare has reported that a Telegram channel combining all three names existed as early as October 2024, well before the alliance label became widely discussed in mainstream coverage. Security firm Resecurity has used a separate term, “Trinity of Chaos,” to describe the same broad alignment of actors.
The overlap is explained less by formal membership and more by shared personnel, shared criminal forums, and shared tactics. Help-desk impersonation, voice phishing, SIM swapping, MFA manipulation, and OAuth-token theft show up across incidents attributed to all three names, which is exactly why attribution in this space moves so slowly and so cautiously even after an arrest is announced.
Competitive Comparison: ShinyHunters vs. Scattered Spider vs. Lapsus$
Treating these three names as competing criminal brands, rather than one monolithic gang, helps explain why law enforcement keeps announcing arrests without the activity visibly slowing down. Each name carries a slightly different specialty, even where membership overlaps.
| Group | First notable activity | Signature tactic | Notable attribution |
|---|---|---|---|
| ShinyHunters | 2020 | Mass database theft and extortion, often via third-party SaaS integrations | FBIJobs.gov, Snowflake-linked retail breaches, Salesforce/Gainsight campaigns |
| Scattered Spider | 2022 | Help-desk impersonation, SIM swapping, MFA bypass | Casino and retail intrusions; frequently paired with ransomware deployment |
| Lapsus$ | 2021 | Social engineering targeting source code and internal tools | High-profile tech-company intrusions; largely dormant as a standalone brand since 2022-2023 |
What distinguishes the current moment is that ShinyHunters, despite being the oldest of the three names, is also the one generating the most active 2026 headlines, including the FBI’s own breach. That longevity is itself notable: Lapsus$ as a standalone brand has gone largely quiet, while Scattered Spider’s visibility tends to spike around individual ransomware incidents. ShinyHunters has instead sustained a near-continuous drumbeat of claimed breaches across six years, surviving prior arrests in France and elsewhere by apparently absorbing or rebranding around detained members rather than collapsing.
Why Data-Theft Groups Keep Evading Arrest
Prior law enforcement action against people linked to ShinyHunters aliases has not been zero. French cybercrime authorities reportedly arrested suspects connected to personas including ShinyHunters, Hollow, Noct, and Depressed during 2025. Yet the group’s name kept appearing in new breach claims through 2026, including the FBI’s own portal. That persistence points to a structural reality rather than investigative failure: these crews operate as loose, Telegram-based communities where a handle can outlive the specific person who first used it, and where financial rewards are large enough that new recruits replace detained members quickly.
It also points to jurisdictional friction. The Netherlands arrest required coordination between the Dutch High-Tech Crime Unit and the FBI, a process that works but takes time and cooperation the bureau does not always get from every country where a suspect might be hiding. Arrests in the Netherlands, Jordan, and the United States, which public reporting counted as at least three across three countries by October 17, 2026, represent a fast pace for this kind of cross-border case.
Market and Industry Impact
The FBIJobs.gov breach claim lands at a moment when enterprise security teams are already stretched thin by a wave of SaaS-platform intrusions tied to the same extended network. Organizations that integrate with Salesforce, Workday, and similar customer-relationship platforms have spent much of 2025 and 2026 auditing OAuth token permissions and third-party connected apps after the Salesloft/Drift and Gainsight-linked incidents exposed hundreds of tenants. A breach claim against the FBI’s own vendor-run jobs portal reinforces a point security vendors have been making for two years: government agencies outsource plenty of low-glamour infrastructure, like employment portals, to third parties, and those vendors are frequently the softest point of entry into an otherwise hardened organization.
For cybersecurity vendors and insurers, each new confirmed arrest is also marketing material. Expect identity-verification, SaaS-security-posture-management, and insider-risk vendors to cite the FBIJobs.gov case in sales decks aimed at government contractors and agencies that still rely on third-party-hosted recruiting software. The case also feeds into a broader federal conversation about vendor risk that has already touched other 2026 breaches at firms like EY and Oracle Health, where third-party access, not a direct network compromise, was the common thread. It also lands in the same window as reporting on a separate credential leak that exposed roughly 82,000 files tied to AI agent tooling, underscoring how much of 2026’s breach activity traces back to access points one step removed from the core network.
Historical Context: How Ransomware-Era Law Enforcement Has Changed
Five years ago, a breach of an FBI-affiliated portal would likely have taken weeks to confirm publicly and months to produce an arrest, if one ever came. The speed of the 2026 response, a public claim from the hackers, an FBI acknowledgment, and two cross-border arrests inside roughly two weeks, reflects a shift in how federal cyber units now operate. Leatherman’s Cyber Division has leaned into public statements naming groups and tactics almost in real time, a departure from the more tight-lipped posture federal agencies kept during the earlier Lapsus$ and Scattered Spider waves of 2021 through 2023.
That shift mirrors what happened after the 2024 Snowflake-linked campaign, when investigators moved relatively quickly to clarify that stolen contractor credentials, not a platform vulnerability, drove the Ticketmaster, AT&T, and Santander incidents. Faster public attribution does not necessarily mean faster convictions, but it does change the information environment the hacking groups operate in, making it harder for a crew to quietly absorb a detained member and keep operating as if nothing happened.
What Happens Next in the Investigation
The FBI has signaled the case is not closed. Patel’s own language around both the September and October arrests described an active pursuit of “more leads,” and the bureau has said it is working with international partners on additional subjects without naming them. That leaves at least three open threads: formal charges against the Netherlands suspect, how the reported federal extortion-related charges against the Pennsylvania suspect proceed, and the broader question of how much FBI personnel data was actually exposed through the third-party vendor platform behind FBIJobs.gov.
None of those threads has been fully resolved in public. The FBI has not confirmed a specific record count for the jobs-portal breach, Dutch authorities have said only that the Amsterdam suspect would remain in pretrial detention for at least 90 days, and the bureau has not detailed what “multiple subjects” arrested with international partners actually means in terms of total headcount. The uncertainty mirrors how slowly facts settled after other major 2026 breach claims, including the South Korea bank hacks that CrowdStrike eventually tied to an AI-linked threat actor weeks after the initial intrusion was disclosed.
Where the ShinyHunters Cases Stand Across Three Countries
By October 17, 2026, public reporting described at least three arrests across three countries, while the investigation continued and the FBI urged remaining members to cooperate. Dutch police arrested a 24-year-old Amsterdam man suspected of participating in ShinyHunters and a criminal organization on September 15, 2026. On September 28, 2026, Reuters reporting cited by The Record said Saif al-Din Khader was arrested in Jordan and may have agreed to cooperate, although that cooperation remains incompletely confirmed.
In the United States, Director Kash Patel said on October 9, 2026, that FBI agents had arrested another suspected co-conspirator in connection with the incident involving the FBI jobs portal. Between October 9 and October 22, 2026, the New York Times and other outlets identified the arrested person as Edward Dubrovsky, a Canadian cybersecurity executive arrested in Pennsylvania, citing people familiar with the investigation and court records. He is detained in the United States and faces federal extortion-related charges allegedly connected to the ShinyHunters investigation, and those charges remain allegations rather than findings.
Readers should also keep the $70 million figure in context. It refers to alleged extortion payments collected by ShinyHunters and co-conspirators since 2025, and it does not establish that the FBI itself lost $70 million. The FBI said the affected jobs platform was operated by a third-party vendor, so the practical step for any organization is to check which vendors hold its applicant and employee data and how those vendors protect access to it.
Predictions: Where This Story Goes From Here
- Expect at least one more publicly announced arrest tied to this investigation within the next month, given the FBI’s stated pattern of following “leads” from each prior arrest in rapid succession.
- The FBI will likely eventually disclose a specific record count or scope for the FBIJobs.gov breach once its internal review concludes, similar to how scope details emerged weeks after initial breach claims in past Salesforce-linked incidents.
- The Pennsylvania suspect, identified as Edward Dubrovsky, already faces federal extortion-related charges, while the Netherlands suspect is held in Dutch pretrial detention on suspicion of participating in ShinyHunters and a criminal organization.
- Security vendors serving government contractors will increase marketing around third-party vendor risk and SaaS-integration audits through the rest of 2026, directly referencing this case.
- ShinyHunters as a brand is unlikely to disappear even if both newly arrested suspects are convicted, consistent with how the network absorbed the 2025 French arrests of personas tied to Hollow, Noct, and Depressed without a visible slowdown in new breach claims.
Frequently Asked Questions
Who did the FBI arrest on October 9, 2026?
The FBI said it arrested “another suspected co-conspirator” tied to ShinyHunters and the FBIJobs.gov breach, according to Fox News. The bureau did not publicly name the suspect. Reporting cited by multiple outlets described the person as a Canadian national arrested in Pennsylvania, though the FBI has not confirmed that detail directly.
Was this the same person arrested in the Netherlands?
No. The Netherlands arrest, announced September 29, 2026, and the Pennsylvania-linked arrest, announced October 9, 2026, are two separate cases involving different suspects, roughly ten days apart.
What is ShinyHunters?
ShinyHunters is a data-theft and extortion group believed to have formed around 2019, first drawing public attention in May 2020 when it advertised stolen databases online. It has since been linked to breaches at companies connected to Snowflake, Salesforce, AT&T, Ticketmaster, and now the FBI’s own jobs portal.
Was the FBI’s internal network breached?
The FBI has described the incident as occurring on a platform managed by a third-party vendor rather than a direct compromise of its core internal network, according to Fox News. The agency has not independently confirmed the full scope of ShinyHunters’ claim that it holds data on almost all FBI employees and applicants.
How does ShinyHunters relate to Scattered Spider and Lapsus$?
Researchers use the term “Scattered LAPSUS$ Hunters,” or SLSH, to describe a loose alliance or shared operating ecosystem among the three names, with overlapping members, shared online forums, and similar tactics like help-desk impersonation and OAuth-token theft, rather than one single formal organization.
Has anyone been convicted in connection with ShinyHunters?
Available reporting as of October 23, 2026, describes recent suspects as arrested or detained, not convicted. Edward Dubrovsky, the Pennsylvania suspect, faces federal extortion-related charges, while the Netherlands suspect remains in pretrial detention.
How much money has ShinyHunters allegedly extorted?
FBI Cyber Division assistant director Brett Leatherman has said the network tied to the Netherlands suspect and co-conspirators allegedly breached more than 140 organizations and extracted at least $70 million in extortion payments since 2025, a figure reported by CBS News. That figure applies to one thread of the broader ShinyHunters ecosystem and is not a confirmed total for every breach attributed to the group since 2020.
What should organizations do in response to this case?
Security teams are being advised to audit third-party vendor access and connected SaaS applications, since nearly every major ShinyHunters-linked breach in 2025 and 2026, from Salesforce integrations to the FBI’s own jobs portal, traced back to a vendor-managed platform rather than a direct network intrusion.
