Arrests of ShinyHunters suspects reach at least three in two weeks after FBIjobs.gov breach

"This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," Patel said ^[2]. "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate," he said ^[3]. The reported detentions number at least three ^[20] and span three jurisdictions: Jordan, Pennsylvania, and an arrest announced with Dutch police ^[21]. The FBI did not respond to requests for details on the latest arrest ^[4].

The group's own channels show it scattering. Over the past two weeks the FBI took down much of its infrastructure, and law enforcement has blocked its attempts to restore its platforms ^[15]. ShinyHunters moved operations back to Telegram this week. On Friday morning it posted that it would not stay ^[16]. "We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI," the group said ^[17].

Signs of escalation are harder to find. ShinyHunters told several news outlets it would not release the stolen information and did not want to escalate the feud ^[18]. Since the arrests began, its public moves have pointed toward retreat, and nothing in the reported record shows retaliation so far ^[18][16]. The group said the feud began over an FBI advisory about its actions that it disagreed with ^[19].

The pledge not to publish is a statement of intent and nothing more. The group has already handed samples to news outlets to prove it held agents' medical records, home addresses, phone numbers and areas of work ^[9]. Last week an internal FBI memo warned employees about the potential danger to them and their families ^[10].

The reported way in was a missed patch. The hackers claimed they got in through a vulnerability in Oracle software that cybersecurity experts had spotlighted in June ^[14]. The FBI reportedly traced the breach to an unidentified Accenture contractor who did not patch a vulnerable system ^[12]. If the hackers' account is accurate, a flaw publicized in June was still unpatched when they got in ^[12][14]. Reuters reported that the contractor was fired this week ^[13].