The FBI publicly warned members of the ShinyHunters cyberextortion group after Dutch authorities arrested a 24-year-old suspect in Amsterdam. ShinyHunters claimed to have accessed the FBIJobs.gov portal on September 21, 2026, and has publicly boasted of breaching more than 140 organizations and collecting at least $70 million in extortion payments. The FBI is investigating but has not confirmed the full scope of the breach; an internal memo reportedly warns that employees' sensitive data could be exposed.
FBI Warns ShinyHunters After Dutch Arrest Tied to FBIJobs.gov Breach Claims
Krblokhin/Getty Images
The FBI has issued a direct warning to members of the cyberextortion collective ShinyHunters after Dutch authorities arrested a 24-year-old in Amsterdam. While officials have not publicly confirmed a direct link between that arrest and the FBI recruitment portal incident, the bureau is treating the situation seriously and urging suspects to cooperate with law enforcement.
What Happened
On September 15, Dutch police detained a 24-year-old suspect they say was a leader within the ShinyHunters group. On September 21, 2026, ShinyHunters claimed responsibility for accessing the FBI's online jobs portal at FBIJobs.gov, publishing screenshots and samples the group described as stolen from the site.
FBI Response
In a public video, Cyber Division Assistant Director Brett Leatherman addressed remaining members of ShinyHunters directly, urging them to contact authorities. Leatherman warned:
"You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."He added that prior arrests often prompt associates to cooperate and that seized infrastructure can reveal the identities of other co-conspirators.
Scope and Uncertainty
The FBI has acknowledged an investigation into unauthorized activity on the recruitment portal but has not confirmed the full scope of any data theft. Dutch authorities have not publicly said the arrest was tied to the FBI incident, and the bureau has not formally linked the arrested individual to the alleged intrusion.
Andrey_Popov/Shutterstock
Potential Impact
Reporting in The New York Times cites an internal FBI memo indicating the bureau is treating all employees as potentially exposed. Possible exposures reportedly include medical records, Social Security numbers, and intelligence-related details. A BBC review of some published materials suggested portions appeared authentic. ShinyHunters has claimed responsibility for dozens of other intrusions — including a major breach at Ticketmaster in 2024 — and the group says it has compromised more than 140 organizations and extracted at least $70 million in extortion payments over the past year.
Why This Matters
Even if the FBI portal incident is not among the largest breaches in history, the case highlights how transnational cybercrime groups operate, the strategic value of seized infrastructure for investigators, and the difficulty of immediately attributing attacks with full certainty. The FBI's public warning signals a push to disrupt the group's operations and to encourage cooperation from lower-level participants.
How To Protect Yourself
If you're concerned about personal data exposure, security experts and the FBI recommend practical steps to reduce risk:
- Monitor financial accounts and credit reports for suspicious activity.
- Enable multi-factor authentication (MFA) on accounts that support it.
- Beware of phishing attempts and verify unexpected requests for personal information.
- Consider a credit freeze or fraud alerts if you suspect Social Security number exposure.
- Keep devices and software up to date with the latest security patches.
Authorities continue to investigate. The Dutch arrest may yield additional evidence, but official confirmation about the full scope of the FBI portal incident has not been released.
Help us improve.
