Key points
- ShinyHunters stole medical records, Social Security numbers, and home addresses from the FBI jobs site.
- Federal investigators suspect two ransomware negotiation executives helped operate the group’s extortion website.
- Authorities detained Pepijn van der Stap and Rey, the group’s current leader, in separate international operations.
The short version
- FBI recruitment website fbijobs.gov was compromised in late September by the ShinyHunters extortion group.
- Stolen files contain sensitive employee data including psychological records and unit specializations.
- Investigators are probing links between the hackers and executives at two ransomware negotiation firms.
The details
FBI employees and job applicants face exposure of highly sensitive personal information after the agency’s recruitment portal was breached. According to KrebsOnSecurity, the stolen files reportedly included medical and psychological records, Social Security numbers, and home addresses. The data also contained details about each employee’s specific unit and area of specialization within the bureau. This breach has prompted an unusually rapid law enforcement response targeting individuals who communicated with the group.
Federal investigators have identified executives at two different ransomware negotiation firms who maintained close ties with ShinyHunters. Sources close to the investigation told KrebsOnSecurity that one U.S. executive even helped the group operate a website designed to pressure victims into paying ransoms. These findings suggest a deeper entanglement between legitimate negotiation services and the extortion ring than previously understood.
The context
The ShinyHunters group has evolved since its inception in 2019, originally operated by criminals in France. Control passed to “Rey,” a teenager from Amman, Jordan, after earlier members were arrested. The FBI states the group has extorted more than $70 million from victims this year. As DataSafe Times reported on October 12, Edward Dubrovsky faces federal extortion charges linked to the group, followed by the detention of Rey on October 3.
Pepijn van der Stap, a senior suspect, was arrested in the Netherlands on the evening of September 15, 2026. Dutch police reportedly used flash-bang grenades to stun and apprehend him as he was logged into various accounts. According to a source close to the investigation, authorities arrested him while he was using his Signal account, which allowed them to read recent communications with frequent contacts, including ransomware negotiators in Canada and the United States.
What should you do?
- Monitor credit reports and financial statements for unauthorized activity or new accounts.
- Review personal address records to ensure no fraudulent changes have been made.
- Check for unexpected mail or calls referencing sensitive medical or psychological data.
- Update passwords for any accounts linked to the exposed email addresses or phone numbers.
For customers and users
Affected individuals should remain vigilant for phishing attempts that reference the stolen data. Attackers often use specific details like home addresses or unit specializations to make fraudulent communications appear legitimate. Teams usually advise checking the sender’s domain carefully and verifying requests through official channels. Do not click links in unsolicited messages claiming to be from the FBI or related agencies. Report suspicious activity to your organization’s security team immediately.
Background: Ransomware
Ransomware exploits weak access controls and connected backups. Protect small teams by enforcing application allowlisting, keeping backups offline, and verifying that IT providers test recovery procedures regularly. These steps reduce attack surfaces without requiring expensive security software.
Read the full guide: Ransomware Risks for Small Teams: Low-Cost Defenses
What to do and how to stay safe: ShinyHunters
- Enable multi-factor authentication on all personal and professional accounts to reduce credential theft risk.
- Freeze credit files with major bureaus to prevent new accounts from being opened in your name.
- Opt out of pre-approved credit offers to limit exposure of your Social Security number.
- Review bank statements regularly for small, unauthorized transactions that indicate compromised card data.
Step-by-step guide: Identity Theft Risks and Low-Cost Protections for Small Teams
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was stolen from the FBI jobs site?
The breach exposed medical and psychological records, Social Security numbers, home addresses, and employee unit specializations.
Who is suspected of helping ShinyHunters operate their extortion site?
Executives at two ransomware negotiation firms are suspected, with one U.S. executive allegedly helping run the site.
Was the ShinyHunters leader arrested?
Yes, Rey, the group’s leader, was detained by Jordanian authorities on October 3 and is cooperating with the FBI.
