US Exec Suspected of Running ShinyHunters Ransom Site After FBI Portal Breach

U.S. federal investigators are examining executives at two ransomware negotiation firms for their role in supporting the ShinyHunters hacking group, according to sources cited by KrebsOnSecurity. These sources indicate that one executive based in the United States directly helped the group operate a website used to pressure victims into paying ransoms.

The scrutiny intensifies after ShinyHunters stole sensitive data from the FBI recruitment website in late September. The stolen files reportedly contained medical records, psychological evaluations, Social Security numbers, and home addresses for agency staff, along with details about their specific units and specializations.

Investigation Background and Suspects

Federal authorities have moved quickly to detain individuals with communications links to ShinyHunters leadership following the breach. Reuters reported on October 3 that Rey, a teenage hacker from Amman, Jordan who controls the group, was detained by Jordanian authorities and is cooperating with the FBI. Rey assumed control after the arrest of a senior member.

On September 15, 2026, Dutch authorities arrested convicted hacker Pepijn van der Stap, a suspected ShinyHunters leader. Police used flash-bang grenades to apprehend Van der Stap while he was logged into online accounts. Investigators accessed his Signal instant messaging history during the arrest, revealing communications with ransomware negotiators in Canada and the United States.

Data Exposure and Group History

ShinyHunters has claimed responsibility for dozens of major data breaches since 2019. The group originally operated from France before leadership shifted as members were arrested. The FBI states that ShinyHunters has extorted more than $70 million from victims this year alone. The recent breach of fbijobs.gov involved the theft of highly sensitive employee data.

The arrest of Van der Stap provided critical intelligence for the investigation. Sources told KrebsOnSecurity that his message logs were instrumental in uncovering a murder-for-hire plot that emerged immediately after his detention. This suggests deep operational entanglement between the hacking group and external criminal networks.

What should you do?

Organizations that have engaged with ransomware negotiation firms should review their vendor relationships for potential conflicts of interest. Monitor official channels for updates regarding the ShinyHunters extortion site and any new indicators of compromise. Ensure that sensitive personnel data is segregated and encrypted to limit exposure if a breach occurs.

What to do and how to stay safe: ShinyHunters

• Audit third-party vendor contracts to ensure negotiation firms have no ties to active threat actors.
• Review access controls on recruitment and HR portals to limit the value of stolen data.
• Monitor dark web forums for leaks of specific employee identifiers or internal unit structures.
• Verify that incident response plans include protocols for handling extortion communications from known groups.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the ransom negotiators hack the FBI website?

No, ShinyHunters hacked the site, but investigators suspect the negotiators helped operate the extortion website and maintained close relations with the group.

Who is Rey in this investigation?

Rey is a teenage hacker from Amman, Jordan, who currently controls the ShinyHunters brand and was detained by Jordanian authorities in October.

What data was stolen from the FBI?

The breach exposed medical records, psychological evaluations, Social Security numbers, home addresses, and information about employee units and specializations.