FBI arrests suspected member of ShinyHunters in connection with jobs site hack

Washington — The FBI this week arrested another individual suspected of being connected to ShinyHunters, the cybercriminal group that hacked the bureau's job website and stole personal data about its employees, FBI Director Kash Patel said on Friday.

"This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly," Patel said in a statement. "This arrest demonstrates the strength and reach of our efforts to protect Americans from cybercrime."

The FBI did not provide any additional details on the individual's identity or the location of the arrest, but a U.S. official and another source briefed on the matter told CBS News the suspect was detained in Pennsylvania. 

A law enforcement source said the suspect is a Canadian citizen and is believed to be directly involved in the hack of the FBI's website. That source said that other suspected co-conspirators remain at large.

The sources were granted anonymity to speak about law enforcement details that have not been made public.

The New York Times reported earlier Friday that the suspect was arrested in Pennsylvania on suspicion of being involved in the theft of FBI data.

An FBI spokesperson declined to comment on the details outlined in the New York Times report.

The FBI's jobs website was hacked in September, in what some veteran agents are saying may amount to the worst breach of a federal government system since the infamous hack of the Office of Personnel Management system in 2015, when more than 22 million government records were stolen.

ShinyHunters claimed responsibility for the FBI hack, the latest in a series of high-profile data breaches committed by the notorious group.

The hackers said they stole 2 to 3 terabytes of data related to FBI workers, a feat they accomplished thanks to a new vulnerability with Oracle PeopleSoft, a human resources management program.

Earlier this week, the FBI's Cyber Division's Assistant Director Brett Leatherman announced that following a review, the bureau determined that a contractor failed to implement a security patch to the system that was targeted.

"The FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce," Leatherman said in a statement. 

Reuters was the first to report on the contractor's removal, saying the individual worked at the company Accenture.

The arrest announced on Friday is the latest in a string of arrests of suspects who are believed to be tied to ShinyHunters.

On Sunday, CBS News reported that Jordanian authorities detained Saif al-Din Khader, who uses the online moniker "Rey" and is suspected to be involved in ShinyHunters.

A second suspected member of the group, identified as 24-year-old Pepijn van der Stap, was also arrested in Amsterdam, CBS News previously reported. 

However, he was taken into custody on Sept. 15, meaning he was already in custody days before ShinyHunters announced it had hacked the FBI jobs website. The intrusion was first reported on Sept. 22 by 404 Media.