The website used by the infamous hacking group ShinyHunters went offline on September 30, a day after the hackers' deadline for the FBI to retract or amend a May advisory about the group expired.

ShinyHunters had claimed on September 22 that it breached the FBI's jobs portal and obtained data relating to "almost ALL FBI Agents" and people who had applied for jobs with the bureau.

The group said its motivation was not financial but a demand that the FBI withdraw what it considered an inaccurate description of its activities.

According to material reviewed by Reuters and other media organizations, samples released by the hackers appeared to contain extensive personally identifiable information, job-related details and sensitive medical and psychiatric information.

ShinyHunters claimed it had extracted between 2 and 3 terabytes of information from FBI systems, including records connected to criminal justice, human resources and medical functions. However, the FBI has not publicly confirmed the full scope of the data allegedly stolen or explained how the intrusion occurred.

The FBI said on September 23 that it was "actively and aggressively investigating" the unauthorized activity involving FBIjobs.gov.

The bureau did not say whether it had taken any action that resulted in the hackers' website going offline. Reuters reported that ShinyHunters could not be reached for comment after the site disappeared.

The group had given the FBI a week to "correct or simply REMOVE" its May advisory. The advisory remained online, while ShinyHunters later said it did not intend to publish the stolen information and had achieved its objectives.

The FBI is investigating unauthorized activity involving its jobs portal after ShinyHunters claimed it stole employee and applicant data. Representational Image AI Generated

The disappearance of the website came amid a separate investigation in the Netherlands. Dutch police announced the arrest of a 24-year-old man in connection with their ShinyHunters investigation.

Three sources cited by Krebs on Security identified the suspect as Pepijn van der Stap, a convicted cybercriminal from Almere who previously served a prison sentence for corporate network intrusions, database theft and extortion. Dutch authorities confirmed that a 24-year-old had been arrested and was due to appear before the Rotterdam District Court.

Van der Stap had previously worked in cybersecurity and volunteered with the Dutch Institute for Vulnerability Disclosure. According to the material, forensic reviews by his employers found no evidence that he had misused access obtained through those roles.

ShinyHunters denied that Van der Stap was associated with the group, while sources cited in the material said investigators were examining possible disputes over control of the ShinyHunters identity.

The FBI incident is also linked in the supplied reports to a wider ShinyHunters campaign exploiting Oracle PeopleSoft systems.

The group claimed to have used the critical CVE-2026-35273 vulnerability, which Oracle disclosed in June. Mandiant and Google's Threat Intelligence Group said ShinyHunters had already been exploiting the flaw as a zero-day against more than 100 organizations before its disclosure.

A later September report documented additional attacks affecting sectors including higher education, healthcare, agriculture, transportation and government.

FBI Cyber Division Assistant Director Brett Leatherman separately urged the hackers to contact the bureau "while the choice is still yours." Mandiant analyst Austin Larsen estimated that ShinyHunters could collect nearly $100 million in extortion payments during 2026.

The Dutch investigation remains ongoing, with authorities having seized multiple data-storage devices and indicating that additional arrests remain possible.