The announcement
On October 9, 2026, FBI Director Kash Patel announced on X that agents had arrested "another suspected co-conspirator of the ShinyHunters group," the group believed responsible for the FBIjobs.gov incident, "which occurred on a platform managed by a third-party vendor." Per Reuters, cited by The Hacker News, it is the third arrest made public since the case broke in late September.
Background: the FBI jobs portal breach
In September, ShinyHunters, a hacking and extortion group, claimed it obtained data on nearly all FBI agents and job applicants. Per Reuters, a sample included names, home addresses, Social Security numbers, assignments and, in some cases, family members' names. The true extent has not been independently confirmed, and the FBI is investigating whether the breach originated in its own systems or at the vendor.
The three public arrests
| Where | When | Source | Suspect |
|---|---|---|---|
| Netherlands | September 15 | Dutch police and FBI | 24-year-old Amsterdam man, identified by Reuters and CBS as Pepijn van der Stap (police did not name him) |
| Jordan | September 29, per Reuters' sources | Reuters | Named by sources as Saif al-Din Khader; reportedly cooperating with the FBI |
| Pennsylvania (US) | week of October 9 | FBI; NYT and CBS | Canadian citizen, not named by the FBI |
Table source: The Hacker News, based on Reuters, NYT and CBS.
Who the third suspect reportedly is (not confirmed by the FBI)
BleepingComputer and KrebsOnSecurity reported that Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania, where he was attending a security conference, on cyber-extortion and conspiracy charges. Krebs describes him as an executive at a ransomware negotiation firm, and multiple sources tie the arrest to the ShinyHunters investigation. Court records show the case moved to the Eastern District of Texas, which sources call the investigation's epicenter.
Important: the FBI has not publicly confirmed Dubrovsky is the announced suspect, no detailed charges are public, and he is presumed innocent. Krebs also reports, citing sources, that charges against other ransomware negotiation firms may follow (unconfirmed).
Why it matters for businesses
- Third-party risk: the FBI itself says the incident happened on a vendor platform. Review what your SaaS vendors store about you and your applicants.
- HR and recruiting data is a prime target: addresses, IDs and family details enable fraud and extortion.
- Vet incident intermediaries: if confirmed, the case shows conflict-of-interest risk among those who negotiate with criminals. Hire incident response with due diligence and clear contracts.
- ShinyHunters remains active: the group is linked to social-engineering attacks on SaaS platforms. Enforce phishing-resistant MFA and control connected OAuth apps.
Sources
- The Hacker News: https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html
- BleepingComputer (Oct 10, 2026): https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
- KrebsOnSecurity: https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
- Fox News (Oct 9, 2026): https://www.foxnews.com/politics/kash-patel-announces-arrest-suspected-shinyhunters-co-conspirator-fbi-jobs-portal-breach
Want to assess your SaaS vendor risk? KGA IT offers a free consultation: kga-it.com.