Full Breakdown
FBI Jobs Portal Hack Triggers International Arrests of ShinyHunters Members
By Drooid · · How we work
Core Event
In late September 2026 the hacking collective ShinyHunters claimed to have breached the FBI’s jobs portal, FBIjobs.gov, exfiltrating personal records of thousands of current and former FBI personnel and applicants. The FBI responded by launching a global investigation and announcing a series of arrests linked to the intrusion.
Background & Context
ShinyHunters, active since 2020, is known for large-scale data theft and extortion. Earlier operations generated at least $70 million in extortion payments from more than 140 organizations. The group’s structure resembles a franchise, with new actors adopting the ShinyHunters brand after earlier members were arrested.
Key Figures & Groups
- Saif al-Din Khader (alias “Rey”) – 17-year-old Jordanian suspect identified as a primary operator of the FBI breach.
- Adem El Adeb (alias “Pryx”) – former associate, now a cybersecurity entrepreneur who warned Khader against the hack.
- Pepijn van der Stap – Dutch national arrested as an alleged leader of ShinyHunters; previously convicted for data-theft-extortion activities.
- Kash Patel – Director of the Federal Bureau of Investigation, overseeing the response.
- Brett Leatherman – Assistant Director of the FBI’s Cyber Division, commenting on the technical cause of the breach.
Timeline
- September 22 2026 – ShinyHunters publicly announces the breach of the FBI jobs portal.
- September 15 2026 – Dutch police arrest Pepijn van der Stap on suspicion of aiding ShinyHunters.
- September 29 2026 – Jordanian authorities detain Saif al-Din Khader; he is reported to be cooperating with the FBI.
- October 3 2026 – The FBI states it has already worked with partners to arrest multiple subjects.
- October 5 2026 – Assistant Director Leatherman reveals a contractor failed to apply a security patch, prompting removal of the contractor from the platform.
- October 9 2026 – Reuters publishes an interview with El Adeb; the FBI announces the arrest of an additional, unnamed Canadian suspect in Pennsylvania.
Data & Statistics
- Internal FBI analysis indicates the breach exposed personal, medical and psychiatric information for more than 5,000 FBI employees and applicants.
- Security researchers estimate ShinyHunters has extorted over $70 million from at least 140 victim organizations since 2025.
Expert Concerns
Cybersecurity analysts warned that the exposure of agents’ personal and family information could enable extortion, swatting and other harassment tactics, raising “alarming national-security implications” for the bureau and its personnel.
On-the-Ground Report
In a video interview recorded in Ras Al Khaimah, El Adeb recounted urging Khader to abandon the plan, describing the teenager as “suicidal” and “crazy.” He said he left cybercrime before turning 18 and is now establishing a cybersecurity firm called VulOne.
Conflicting Reports & Gaps
- The identity of the Canadian suspect arrested in Pennsylvania remains undisclosed; sources confirm the arrest but differ on whether the individual directly participated in the FBI breach.
- Estimates of the number of compromised FBI records vary between “thousands” and the more precise figure of over 5,000, reflecting limited public verification.
Verbatim Quotes
- “We thought it was cool when we were kids,” — El Adeb
What’s Next
The FBI has indicated that its investigation remains active, with officials emphasizing ongoing cooperation with international partners to locate remaining ShinyHunters affiliates and to secure any compromised infrastructure. No specific future hearings or deadlines have been announced.