FBI Director Kash Patel announced on Friday, October 9, 2026, that agents had arrested another suspected co-conspirator of the ShinyHunters group, the crew believed responsible for the breach of fbijobs.gov, a platform he said was managed by a third-party vendor. Patel framed it as the latest arrest "in a matter of days" as the bureau works to dismantle the network. According to The New York Times and CBS News, the suspect is a Canadian citizen arrested in Pennsylvania, reportedly considered a primary co-conspirator in the intrusion. The FBI has not named the suspect or disclosed any charges, and no court filing has been made public.

This is the third publicly announced arrest since news of the breach broke in late September, making the pace itself the story. Patel's language about dismantling "what's left" of the group signals an ongoing net-closing operation rather than a single closing act — and the Pennsylvania suspect's identity rests on unnamed-source reporting the bureau has not confirmed.

ShinyHunters claimed in September it breached the FBI's jobs portal and stole data on nearly all FBI employees. The FBI says the intrusion occurred on a contractor-managed platform after the contractor failed to install a security patch explicitly issued to secure it; the FBI has removed that contractor. BleepingComputer reports the group claimed it exploited an Oracle PeopleSoft zero-day and stole 2TB to 3TB of data, including employee home addresses, Social Security numbers, sensitive job assignments, medical records and family members' details. Reuters sources identified the platform as Oracle PeopleSoft and the contractor as Accenture, which did not answer questions about it.

ShinyHunters told outlets it targeted the FBI over a May advisory it says made false claims, describing the group as one that specializes in large-scale data breaches and extortion and sometimes fabricates compromising material. CNN reports the group used its dark-web site to demand the FBI amend the advisory, saying it was "offended" by the characterization — a demand widely read as a tacit leak threat the hackers later disavowed. The FBI alleges ShinyHunters has breached more than 140 organizations and taken at least $70 million in extortion payments since last year.

Experts cited in the pack's coverage note that the exposed data could let adversaries identify FBI personnel working in sensitive units on China and Russia, and expose agents and their families to extortion, swatting and harassment. The Record reports the breach also exposed thousands of records on local police officers who work with the FBI on task forces, and the bureau sent an internal memo warning employees of potential danger. The incident also puts the FBI in the unusual dual role of breach victim and lead investigator, drawing scrutiny from lawmakers and security researchers.

Expect the gap between "arrested" and "formally charged" to persist for days or weeks, consistent with how the bureau has handled earlier arrests in the same investigation. The Record reports the group's main Telegram representative went silent, its leak site went offline, and the group announced it would not remain active on Telegram, though a new leak site later appeared. FBI Cyber Division Assistant Director Brett Leatherman has publicly urged remaining members to surrender, saying "arrests have a way of changing who is willing to talk." No link between the Pennsylvania arrest and the Jordan detention has been established, so treat any claimed connection as unverified.