A crime gang with a grievance

A crime gang with a grievance. ShinyHunters says it hacked the FBI's recruitment systems in retaliation for a public warning, and wants the warning withdrawn. The group is still best described as criminal. What that word cannot capture is how much a loose, arrest-resistant network can now do to a state institution. On 22 September, a group of extortionists complained about the FBI's public messaging, and backed the complaint with what it says is a trove of stolen FBI data. ShinyHunters says it broke into the systems behind the Bureau's jobs portal in response to a public warning the FBI had issued about the group. That warning, published in May, described the group's tactics and urged victims not to pay. In its message to the FBI, the group said it was offended by the characterisation and demanded that the Bureau take it down. Analysts quoted by CyberScoop said the group presented the warning as an attempt to undermine victims' willingness to pay. That is an unusual thing for a criminal enterprise to ask of a government. It is a customer-relations dispute conducted with stolen personnel records. What is established, and what is not A compromise of the jobs portal now looks substantially established, though the FBI's own wording is more guarded than that. Its official statement is headlined as concerning a compromise of the portal, but the text describes a criminal group claiming one, with an alleged impact on employee data. Independent checking has gone further. 404 Media received a sample of stolen records and, according to KrebsOnSecurity, reported that it includes Social Security numbers and personal details for more than 5,000 officials. Reuters reviewed documents the group supplied and partially authenticated some of them, including psychiatric and medical evaluation records, while stating that it could not tell whether they were representative of a larger trove. In each case the material came from the attackers, so what has been tested is what the documents contain, not how they were obtained. Several things remain uncertain. The full volume and contents are unknown, and the group's claim of a much wider intrusion into several FBI services, with around two terabytes taken, is unconfirmed; Reuters likewise could not corroborate those specific claims. The route in is also unresolved. The FBI says the point of breach is undetermined, whether at a third-party supplier or inside its own enterprise, and that it is working with the providers behind the portal. The group says it exploited a flaw in Oracle's PeopleSoft software. Google's Mandiant has since reported mass exploitation of one such flaw, CVE-2026-35273, but no public evidence yet ties the FBI intrusion to it. Why the law says crime There is an instinct to reach for a bigger word. That instinct deserves a direct answer, and on the evidence so far the answer is no. In Britain, the Terrorism Act 2000 requires an intention to influence a government or intimidate the public, and that the action be undertaken to advance a political, religious, racial or ideological cause. Serious interference with electronic systems can qualify, but the motive test still applies. American law contains several overlapping definitions, but US terrorism frameworks also generally look for an ideological, political or coercive purpose that ordinary extortion lacks. ShinyHunters does not meet that standard on the evidence. Its record is one of sale and extortion. When the US Department of Justice secured the conviction of an early member, Sébastien Raoult, prosecutors described his motive as pure greed. The FBI grievance does not change this, and the group has said so itself. It told The Register that it was just "protecting our business as any other business would do", and described the operation as a public-relations and marketing exercise. Its statement on Monday called the episode a marketing campaign and said it never intended to publish the data, recasting its earlier demand that the FBI retract its advisory. The group's accounts have shifted and are self-serving, and it has not said the records were deleted, but they agree on the point that matters here: the warning was bad for business. The distinction also protects something worth protecting. Legal categories determine which powers the state may use, against whom, and with what oversight. A definition of terrorism stretched to cover every damaging intrusion would be convenient for investigators and corrosive for everyone else. But the word "criminal" is doing two jobs. It describes the motive, and so fixes the legal response: investigation, prosecution, extradition. It does not describe the strategic effect. A group with no political programme can still expose the home addresses of intelligence-adjacent staff, pressure individual employees and disrupt a government's hiring pipeline. The motive is commercial. The consequences are not confined to commerce. A brand, not an organisation That gap widens because of how the group is built. Google's Mandiant unit described the activity in January as several threat clusters operating under one banner, with separate actors handling intrusion and extortion. One threat-intelligence profile calls the name a brand used by a fluid network of affiliates, with no confirmed leader. Its methods have moved beyond stealing and selling databases: Mandiant has recorded callers posing as IT staff, fake login pages, attackers registering their own devices for multi-factor authentication, and harassment of victim personnel. Arrests have not ended it. Raoult was arrested in Morocco in 2022, extradited in 2023 and sentenced to three years in 2024 over the theft of data from more than 60 companies. French police arrested four suspected associates in June 2025, but researchers noted that those held were affiliates rather than leaders and operations continued. This month Dutch police arrested a 24-year-old Amsterdam man on suspicion of playing a role in the group, and on 29 September a Rotterdam court ordered him held for a further 90 days. The same day FBI Director Kash Patel described the arrest as that of "one of the alleged leaders of ShinyHunters". Neither Patel nor the police named the suspect, and the police announcement neither confirmed the leadership claim nor mentioned the FBI breach. Reporting has identified him as Pepijn van der Stap, and ShinyHunters has said he has no association with it. The group claimed the FBI attack days after the arrest. Sources cited by Krebs describe a dispute among rival hackers over control of the brand itself, which is unverified but is consistent with the picture: a name that outlasts its members and can be contested by them. It is also now a live test. If the arrest of an alleged leader slows the group, the argument here weakens; if operations continue, it strengthens. What suppression looks like A state can destroy an organisation more easily than it can destroy a market, a skillset or a brand. That is the real difficulty. Governments learned to disrupt hierarchies, and ShinyHunters is not one. Individual participants can disappear while the name, the methods, the buyers of stolen data and the available labour remain. A Mandiant researcher told Krebs the group was on track to collect close to $100 million in extortion payments this year. While that pays, recruitment will continue. There is also an asymmetry of effort. A state must gather evidence, attribute the attack, identify a person, satisfy a foreign court and persuade another government to hand him over. When Mandiant published firewall rules to blunt the PeopleSoft flaw, the group changed a single character in the request path so that filters matching the literal text missed it, and web shells then appeared on dozens of systems across government, healthcare, transport and other sectors. Substantial institutional consequences followed from a very cheap adaptation. The realistic aim is therefore suppression, of the kind governments already accept for drug trafficking and organised crime: make the trade harder, dearer and more dangerous. Prosecutions raise the personal cost. Seizures of infrastructure, such as the US takedowns of BreachForums domains, create uncertainty. Defenders can remove the easy routes, and patching a flaw rather than relying on a temporary filter is the plainest example. The counter-reading The strongest objection is that the current classification works. Treating ShinyHunters as a criminal enterprise has produced convictions, extraditions and forum seizures, and it keeps the response inside courts and evidential standards. Calling the group something more exotic would risk importing emergency powers into a problem that is fundamentally about money. It could also flatter the group: a gang eager for notoriety would welcome being treated as a peer of states. There is a further caution. The retaliation story is the group's own. It may be true, partly true, or brand theatre designed to make a routine extortion campaign look bolder. The FBI has not adopted that account and neither should anyone else until the forensic picture is clearer. None of that undermines the case for the label. We may not need a new legal noun at all. What we need is to keep classification and consequence apart: to prosecute ShinyHunters as criminals, because that is what the evidence shows, while planning against it as an actor that can produce strategic effects. Governments that manage only the first will keep treating each incident as a technical failure to be repaired, and those that manage only the second will keep reaching for emergency powers they should not need. Sources: FBI (statement of 23 September), Reuters (via U.S. News), KrebsOnSecurity, The Register, Nextgov, TechCrunch, The Hacker News, AP (via WSLS), CyberScoop (via ASIS Security Management), SecurityWeek, Hackread, Help Net Security, Google Cloud / Mandiant, Huntress, CybelAngel, IBTimes, WCYB (carrying the Patel announcement), UK legislation.gov.uk, Wikipedia (BreachForums). The 404 Media findings are cited as reported by KrebsOnSecurity.