Key points
- ShinyHunters stole medical records, Social Security numbers and home addresses from the FBI jobs website in late September.
- Federal investigators identified executives at two ransomware negotiation firms who maintained close ties with the extortion group.
- One US-based executive is suspected of helping operate the ShinyHunters extortion website to pressure victims into paying ransoms.
Federal investigators are examining whether ransomware negotiators aided the ShinyHunters hacking group after it stole sensitive data from the FBI recruitment website. The breach exposed private details of FBI staff, prompting a rapid response from law enforcement agencies.
Sources close to the investigation tell KrebsOnSecurity that executives at two different ransomware negotiation firms maintained unusually close relations with the extortion group. One executive based in the United States is suspected of helping ShinyHunters operate a website designed to pressure victims into paying ransoms.
Context and background
ShinyHunters has claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France. Control of the brand passed to a teenage hacker from Amman, Jordan, known as Rey, after original members were arrested.
The FBI states that ShinyHunters has extorted more than $70 million from victims this year. The group’s recent activity includes the late September breach of fbijobs.gov, where hackers threatened to publish stolen files containing sensitive employee information.
Who is affected
The stolen files reportedly included medical and psychological records, Social Security numbers and home addresses. The data also contained information about each employee’s unit and specialization. This exposure impacts current FBI personnel whose records were stored on the recruitment portal.
Reuters reported on 3 October that Rey had been detained by Jordanian authorities and was cooperating with the FBI. The detention follows the arrest of Pepijn van der Stap, a convicted hacker and ShinyHunters suspect, in the Netherlands on the evening of 15 September 2026.
Our take on the response
Dutch police used flash-bang grenades to apprehend Van der Stap while he was logged into various online accounts. Investigators accessed his Signal instant messaging account, revealing communications with ransomware negotiators based in Canada and the United States. These messages helped unravel a murder-for-hire plot that emerged immediately after his arrest.
What affected people can do
Security teams should advise affected individuals to monitor their credit reports for unusual activity. Users must check whether their home addresses or Social Security numbers appear in data breach databases. It is crucial to recognise follow-up scams that often cite this incident to steal further credentials. Teams usually recommend enabling multi-factor authentication on all sensitive accounts immediately. Affected staff should verify any communication claiming to be from federal agencies, as attackers often impersonate official bodies to exploit the confusion surrounding such high-profile breaches.
What to do and how to stay safe: ShinyHunters
- Review credit reports for unauthorised inquiries or new accounts opened in your name.
- Enable multi-factor authentication on email and financial accounts to reduce the risk of credential theft.
- Monitor bank statements and credit card transactions for small, unrecognised charges that may indicate testing.
- Be cautious of unsolicited emails or calls claiming to offer remediation for this specific breach, as these are often phishing attempts.
Step-by-step guide: Stop Credential Leaks: 3 Immediate Actions to Secure Accounts
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was stolen from the FBI jobs site?
The stolen files included medical and psychological records, Social Security numbers, home addresses, and information about each employee’s unit and specialization.
Who is suspected of helping ShinyHunters operate their extortion site?
An executive at a ransomware negotiation firm based in the United States is suspected of helping the group operate the website that pressured victims into paying ransoms.
Has the leader of ShinyHunters been caught?
Reuters reported on 3 October that Rey, the teenage hacker from Jordan who controls the group, was detained by Jordanian authorities and is cooperating with the FBI.