Skip to content
FBI Arrests Multiple Suspects Linked to ShinyHunters Data Breach

FBI Arrests Multiple Suspects Linked to ShinyHunters Data Breach

First seen 9 Oct 2026, 17:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 10, 2026 at 17:35 UTC
  • •ShinyHunters claimed responsibility for a breach affecting nearly all FBI employees.
  • •The breach exploited a critical vulnerability in Oracle's PeopleSoft software.
  • •The FBI has arrested multiple suspects, including a Canadian citizen and a teenager in Jordan.

The FBI has arrested several members of the ShinyHunters hacking group, which claimed to have breached the FBI's jobs portal and stolen sensitive data on nearly all employees. The breach, attributed to a vulnerability in Oracle's PeopleSoft software (CVE-2026-35273), exposed personal information of approximately 5,000 FBI personnel. The FBI's investigation revealed that the breach occurred due to a contractor's failure to apply a security patch. Arrests include a Canadian citizen detained in Pennsylvania and a teenager in Jordan cooperating with authorities. The FBI has intensified efforts to dismantle the group, which has reportedly extorted over $70 million from various organizations since 2025.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2d ago How this analysis works

Timeline

2026-06-11
CVE-2026-35273 published
Oracle's PeopleSoft vulnerability was published, rated CVSS 9.8 critical.
Krebsonsecurity
2026-09-15
Dutch police arrest ShinyHunters leader
A 24-year-old Dutch national, Pepijn van der Stap, was arrested as part of the ShinyHunters investigation.
Bleepingcomputer
2026-09-28
Jordan arrests ShinyHunters member
Saif al-Din Khader, a teenager, was detained in Jordan and is cooperating with the FBI.
Krebsonsecurity
2026-10-09
FBI arrests Canadian suspect
The FBI arrested a Canadian citizen in Pennsylvania linked to the ShinyHunters breach.
Cbsnews

More articles in this cluster (85)

Following this threat?

Track ShinyHunters, Accenture and CVE-2024-50623 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (28)

1 / 4

Common questions

What data was compromised?
The breach exposed sensitive personal information of nearly all FBI employees, including names, addresses, and Social Security numbers.
How did the breach occur?
The breach exploited a critical vulnerability in Oracle's PeopleSoft software due to a contractor's failure to apply a security patch.
What actions is the FBI taking?
The FBI is actively arresting members of ShinyHunters and working to dismantle the group while investigating the breach.