FBI Arrests Suspects in ShinyHunters Cyberattack on Bureau
FBI arrests multiple suspects linked to ShinyHunters’ hack that targeted the bureau’s systems.
1 min read
The FBI has arrested multiple suspects connected to a September cyberattack that targeted the bureau itself, allegedly carried out by the notorious hacking group ShinyHunters. The operation, which included the defacement of the FBI’s jobs site, has led to ongoing investigations and arrests across international borders.
Hackers Claim Data Compromise
ShinyHunters took credit for the hack, claiming they had access to sensitive data on all FBI employees and applicants. The group defaced the FBI jobs site, apply.fbijobs.gov, and displayed a message that mimicked a law enforcement seizure notice. The message stated that all FBI data, including personally identifiable and protected health information, had been compromised.
Arrests and Cooperation
The FBI has worked with international partners to arrest several suspects, including Saif al-Din Khader, who goes by the alias Rey. Khader was detained in Jordan and is reportedly cooperating with the FBI to help identify other members of the group. Khader had previously confirmed his identity to security journalist Brian Krebs and was described as the technical operator and public face of a related group.
Connections to Other Cyberattacks
Khader is also linked to a major breach of Jaguar Land Rover in late 2025, which disrupted manufacturing and led to significant financial losses. The breach, attributed to ShinyHunters, was one of the most costly cyberattacks in UK history. The FBI has also arrested a 24-year-old Dutch national, identified as Pepijn van der Stap, who was previously convicted for hacking and extorting organizations.
FBI’s Continued Investigation
Brett Leatherman, assistant director of the FBI’s Cyber Division, released a video message urging remaining members of ShinyHunters to come forward. He emphasized that arrests and seized infrastructure could reveal more about the group. The FBI declined to provide further details about the video or the status of seized infrastructure.
Source: Breitbart
