FBI agents arrested another suspected member of the ShinyHunters hacking group earlier this week, Director Kash Patel said Friday, as the bureau pursues the hackers it believes were behind last month's breach of its jobs website and the theft of personal data on its employees.
"Earlier this week, our agents in the field arrested another suspected co-conspirator of the ShinyHunters group," Patel said in a statement. He described it as "the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," and he added: "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate."
The statement did not name the suspect, say where the arrest took place, describe the person's alleged role or specify any charges. The FBI declined to give CNN further details, and a bureau spokesperson would not comment to CBS News on specifics reported by The New York Times.
The Times, which first reported the arrest, described the suspect as a Canadian man taken into custody in Pennsylvania, citing two sources. CBS News reported separately that a U.S. official and another source briefed on the matter placed the arrest in Pennsylvania, and that a law enforcement source described the suspect as a Canadian citizen believed to have been directly involved in the hack of the FBI's website. Two sources familiar with the matter told CNN that officials believe the man helped orchestrate the hack and that investigators are still examining others thought to have taken part.
The Royal Canadian Mounted Police said in a statement to CBS News that it "is aware of the arrest of a Canadian in the US in connection with the ShinyHunters hack," adding that it does not comment on investigations being conducted by other countries.
ShinyHunters claimed responsibility last month for breaking into the FBI's jobs portal. The intrusion was first reported on Sept. 22 by 404 Media, and the hackers said they took 2 to 3 terabytes of data related to FBI workers by exploiting a vulnerability in Oracle PeopleSoft, a human resources management program. The group has said it acted over what it called false allegations in a May FBI advisory that described it as a "cyber criminal group specializing in large-scale data breaches and extortion." Patel's statement on Friday said the incident "occurred on a platform managed by a third-party vendor."
The group shared samples of the stolen material with news outlets. Nextgov/FCW said one it received held roughly 5,000 entries, including names, home addresses, phone numbers and information about relatives, and identified personnel in intelligence and surveillance roles. A sample shared with Reuters also contained Social Security numbers and assignments, and CNN, citing sources who have seen the data, reported that the identities of FBI personnel working in sensitive units on China and Russia were exposed. Reuters has reported that an internal memo circulated within the FBI said officials were working on the assumption that all current and former employees had been exposed, though the full extent of the breach has not been independently confirmed.
The bureau has blamed a missed security update for the intrusion. Brett Leatherman, assistant director of the FBI's Cyber Division, has said a contractor failed to apply a security patch to the targeted system. "The FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce," he said. Reuters, which first reported the removal, said the contractor worked for Accenture.
Some veteran agents have called it possibly the worst breach of a federal government system since the 2015 hack of the Office of Personnel Management, when more than 22 million government records were stolen. Experts cited by The Associated Press said the exposure could leave agents and their families open to extortion, swatting and other harassment. Jason Pack, a retired FBI supervisory special agent, has drawn a line between stolen personnel records and the bureau's classified investigative systems. "Based on what we know right now, there is no indication they have the keys to the kingdom," he told Fox News Digital.
Friday's announcement follows arrests overseas. Dutch police took a 24-year-old man into custody in Amsterdam on Sept. 15, days before ShinyHunters announced the FBI hack, and on Sept. 29 Patel said the Dutch National Police had arrested one of the group's alleged leaders. Leatherman said at the time that the suspect and his alleged co-conspirators had breached more than 140 organizations and collected at least $70 million in extortion payments since last year. Jordanian authorities have also detained a suspected member of the group, who Reuters has reported is cooperating with investigators.
The FBI has taken down much of the group's infrastructure over the past two weeks, The Record reported, and on Friday morning ShinyHunters posted in one of its Telegram groups that it would not stay on the platform much longer "as several of our members have reportedly been arrested by the FBI." The group has told news outlets it will not release the stolen FBI data, though Nextgov/FCW noted that the information could still be sold to foreign intelligence services or other buyers.
Leatherman addressed the hackers directly in a video after the Dutch arrest. "Arrests have a way of changing who is willing to talk and seized infrastructure has a way of showing us who is left," he said. "The longer you stay in this, the more we learn about you."