FBI Arrests Suspect in ShinyHunters Data Breach Case

The FBI arrested a suspected co-conspirator linked to the ShinyHunters hacking group after the cybercrime operation exposed personal information from thousands of bureau employees through the FBIJobs.gov platform managed by a third-party vendor, according to FBI officials.

The arrest was announced by FBI Director Kash Patel, who said the breach involved an unclassified system used for job recruitment. The FBI discovered the incident in late September and said employee names, addresses, contact details, Social Security numbers, dates of birth, and emergency contact information were affected.

"Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor," said Kash Patel, FBI Director.

Patel said the investigation was part of broader efforts to respond to cybercrime. The FBI previously said the group had obtained personnel records from the compromised recruitment platform.

"This arrest demonstrates the strength and reach of our efforts to protect Americans from cybercrime," said Kash Patel, FBI Director.

FBI Cyber Assistant Director Brett Leatherman said the breach resulted from a security failure involving a third-party organization. The FBI removed the contractor responsible for the affected platform after determining that a required security patch had not been applied.

"To date, our review has determined that the incident occurred as the result of a security failure of a platform managed by a third-party organization - after a contractor failed to implement a security patch explicitly issued to secure the platform," said Brett Leatherman, FBI Cyber Assistant Director.

The FBI said it took steps to reduce further risk and protect employees. A bureau notice also advised affected personnel to remain alert for suspicious communications.

"removed" was used by the FBI in describing the action taken against the contracting company responsible for the affected platform.

"trespassing" appeared in an FBI notice instructing employees on how to respond if media members entered restricted areas.

KrebsOnSecurity reported that the arrested suspect was Edward Dubrovsky, a Canadian cybersecurity professional linked to ransomware negotiation services. Court records showed an Edward Dobrovsky was arrested on October 8 in Pennsylvania on cyber extortion and conspiracy charges.

"conspiracy to threaten to impair the confidentiality of information with the intent to extort money" was included in a court record summary describing one of the charges against the defendant.

According to KrebsOnSecurity, Dubrovsky co-founded cybersecurity companies and had planned to attend the Cyber Risk Summit in Philadelphia. His LinkedIn profile described work involving ransomware response and negotiation services.

"Looking forward to continuing conversations around strategy & compliant driven coercive (ransomware, extortion) advisory, negotiations and settlement services that are global and truly agnostic," wrote Edward Dubrovsky in a LinkedIn post.

Dubrovsky was also identified as the author of a book about cyber extortion response. The book listing described approaches organizations can use when dealing with criminal groups.

"At the heart of the book is a critical distinction: communicating with a criminal is not the same as negotiating a payment, and negotiating is not a commitment to pay," reads an excerpt from the book listing associated with Edward Dubrovsky.

KrebsOnSecurity reported that the FBI investigation into ShinyHunters expanded after other arrests connected to the group. A member using the name "Rey" was described as taking control of the group after another suspect's arrest.

"Rey" was the name used for a ShinyHunters member described in reporting about the investigation.