They skipped the patch and called it an arrest. I know the sentence. It is what a bureau says when the door was left unlocked on a contractor’s watch, the names spilled onto the dark web, and the remedy offered to the public is a handcuff photo and a video addressed to the thieves.
On Friday, October 9, 2026, at 1:19 p.m. Eastern, CNN’s Sean Lyngaas and Evan Perez reported that the FBI arrested a man in Pennsylvania who officials believe helped orchestrate a recent damaging hack that exposed sensitive data of current and former FBI personnel, according to two sources familiar with the matter. FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or what role the man is suspected of playing. “Earlier this week, our agents in the field arrested another suspected co-conspirator” of the cybercriminal group believed responsible, Patel said. An investigation into others is ongoing, the sources said. Last week, CNN notes, the FBI announced that Dutch authorities arrested “one of the alleged leaders” of the group known as ShinyHunters; the New York Times first reported the Pennsylvania arrest. ShinyHunters last month claimed responsibility for breaking into an FBI jobs portal and gaining access to personal data on thousands of current and former FBI employees; identities of personnel working in sensitive units on China and Russia were exposed, according to sources who have seen the data, CNN reports. The hackers used a dark-web site to demand the FBI amend a previous advisory about the group, saying they were “offended” by how the agency described their alleged extortion tactics — a demand many in cybersecurity took as a tacit threat to leak the stolen data; the hackers later claimed that was never their intention. Amid internal criticism that security resources for victims felt underwhelming, Patel and senior FBI cyber official Brett Leatherman put out public statements and video messages with updates, some addressed to the cybercriminals. “Arrests have a way of changing who is willing to talk and seized infrastructure has a way of showing us who is left,” Leatherman said after the Dutch arrest. “The longer you stay in this, the more we learn about you.” There has also been an inquest into how the lapse happened. The FBI determined that a contractor managing the bureau’s jobs portal failed to update software “explicitly issued to secure the platform,” Leatherman said last week; the FBI has “removed the contractor.” The software, ShinyHunters has said, is a human-resources platform made by Oracle. Google’s Threat Intelligence Group, CNN reports, said the hackers previously used a flaw in that software against education-sector targets in May and June — but months later the FBI contractor apparently still had not applied a security patch that was available.
UCraig asked whether a patch was the same thing as a password on a sticky note. Dr. Ellery, off the clock, said the clinical term for arrest-as-aftercare is “displacement.” Deb wanted to know if the jobs portal still asked for a résumé. I love them. They are seasoning.
Arrest is the alibi. The skipped patch is the story. Sit with the timeline until it confesses. A flaw used against schools in May and June. A patch available. A federal jobs portal still unpatched months later on a contractor’s watch. Names of agents — including people who work China and Russia files — exposed. Then: remove the contractor, film a message to the hackers, announce a Dutch arrest, announce a Pennsylvania arrest, and ask the country to feel safer because a handcuff entered the narrative. I am not crowning ShinyHunters. Extortion theater on a dark-web site is not accountability, and “we were offended by your advisory” is not a civil right. I am not crowning the bureau for catching someone after the vault was open. Catching someone is the job. The job before that was keeping the door locked when the vendor already mailed the key. Oracle sells the platform; a contractor failed to update it; the bureau hosted the portal and then discovered, in public, that “explicitly issued to secure the platform” is a sentence you only need after the breach. That is not a glitch in procurement. That is procurement as the soft underbelly of the national-security brand. I am not recruiting the other party as the hero. Both parties are the help when they get near a federal IT contract — one signs the vendor, one holds the hearing, neither one is the agent whose home address just became a souvenir. I am keeping the cardigan. Fill the notebook. Then ask, out loud, why the patch was optional when the names were not.
— Theo Ashford-Lindström
Leave a Reply