Authorities Send A Warning To Hackers After Arrest Linked To FBI Data Breach

While the recent data breach of the FBI's recruitment portal may not qualify as one of the worst in the internet's history, the bureau is clearly treating it very seriously. On September 15th, Dutch authorities arrested a 24-year-old from Amsterdam whom they claim was one of the leaders of cyberextortion group ShinyHunters, which claimed responsibility for the breach (ShinyHunters is also the organization responsible for the massive Ticketmaster breach in 2024). In response, the FBI has issued a warning to other members of the group in a video statement by Cyber Division Assistant Director Brett Leatherman.

In the video, which details the arrest, Leatherman speaks directly to remaining members of ShinyHunters, urging them to proactively reach out to law enforcement. "You know how to find us, and we know how to find you," Leatherman said. "I suggest you reach out first while the choice is still yours."

Interestingly, the arrest happened before the alleged breach. Dutch police have not explicitly stated that the arrest was tied to the FBI breach, nor has the FBI formally tied the individual arrested to the attack. In the video, Leatherman describes ShinyHunters as a global cybercrime group linked to attacks in the United States, the Netherlands, and elsewhere. He goes on to claim the group has breached more than 140 organizations in the last year alone, racking up at least $70 million in extortion payments.

On September 21st, 2026, ShinyHunters claimed that it had compromised the FBI's online job portal at FBIJobs.gov. As evidence of their claim, the group shared a number of screenshots and other samples of data stolen from the web portal. The FBI has since responded by acknowledging that it's investigating unauthorized activity at the site, but has not officially confirmed the scope of the theft. However, according to The New York Times, an internal memo says that the bureau is treating all employees as potentially exposed, including information about their medical records, Social Security numbers, and intelligence-related details.

ShinyHunters has made expansive claims about the records it was able to access, and a BBC review of a portion of the material indicated that it appeared genuine. According to the group, the breach wasn't perpetrated to extort money from the FBI or U.S. government but was in response to a bureau advisory that claimed ShinyHunters uses exaggerated claims of data access to pressure victims into paying out.

In the video statement, Leatherman said prior arrests often prompt associates to cooperate and that "seized infrastructure" can also reveal the identities of other co-conspirators. It represents a blunt message from the FBI that the hackers' anonymity is fragile, and that the Dutch arrest will like produce new evidence against remaining members. If you're concerned about your own data security, here are some ways to protect yourself against different types of cyberattacks.