The FBI and the Dutch National Police said Tuesday that they had arrested suspected member of the notorious cyber group ShinyHunters, the group that claimed responsibility for last week’s defacing the FBI’s jobs website and bragged that it had stolen data about FBI personnel and job applicants.
The Dutch National Police said Tuesday that the suspect is a 24-year-old from Amsterdam, and was arrested on September 15 on suspicion of being a member of ShinyHunters. That means he was already in custody days before ShinyHunters announced it had hacked the FBI jobs website, which was first reported on Sept. 22 by 404 Media.
He is also suspected of attempting incitement to commit two murders, Dutch authorities said.
The Dutch authorities said they had seized several data carriers and further arrests in the case could not be ruled out. They said a large amount of information was discovered on his laptop, including the details about the two murders that were supposed to be committed abroad. The suspect is being held in insolation, and he is expected to be held in pre-trial detention for at least 90 days, Dutch authorities said.
FBI Cyber Division Assistant Director Brett Leatherman said Tuesday that Dutch authorities had the “full support” of the FBI.
“Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments,” Leatherman said. “They often target third-party vendors and cloud-based platforms, stealing sensitive data and extorting victims with threats to publishing.”
In a post on X, FBI Director Kash Patel did not identify the individual who was arrested, but referred to the person as “one of the alleged leaders” of the organization. “As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” Patel wrote.
The FBI said in a statement that it is “working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted — including multiple Bureau wide communications within 24 hours of public reporting.” The FBI also said that the investigation is ongoing.
Last week, ShinyHunters claimed in communications posted on the dark web and exchanges with multiple media outlets that it stole two to three terabytes of data related to FBI and Justice Department workers. The hackers said they used a new vulnerability in Oracle PeopleSoft, a human resources management program.
In one such post last Tuesday, ShinyHunters addressed Patel and Leatherman, saying: “We have compromised the FBI.”
The cybercriminals said they possessed sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs. It listed criminal justice, human resources and Medlink systems among the services that were affected.
On Monday, The New York Times reported that FBI employees had received an internal email that declared the hack to be a cybersecurity incident and acknowledged that personal information of some employees had been stolen.
That internal security notice sent to employees at the FBI recently confirmed that hackers did obtain employee information, a sample of which was shared with some select members of the media, according to a source with knowledge about the internal communication.
The FBI told employees that multiple divisions are now investigating the breach and coordinating support for those who were impacted.
Employees were also advised to take heightened security precautions and that they should report suspicious contacts, harassment or any threats they may receive.
The internal communication also told employees that the bureau is evaluating additional identity protection and related support services for affected employees and their families.
An FBI spokesperson declined to comment on the notice’s contents, but said that the bureau has been in constant communication with its employees since the incident took place, and added that the FBI has been providing notifications and updates as more information became available.
