The Record reported on Friday that the FBI arrested another suspected ShinyHunters member earlier this week. The New York Times reported the arrest was in Pennsylvania and involved a Canadian national. The Record says at least two other suspects were detained in the past two weeks. The group took over FBIjobs.gov and stole data on nearly every FBI employee. Reuters, citing FBI sources, said Saif al-Din Khader was arrested in Jordan on September 28. The Record adds he allegedly agreed to help find other members.
The FBI gave The Record no details on the latest arrest. The Record says the FBI reportedly traced the breach to an unnamed Accenture contractor who left a system unpatched. Reuters says the contractor was fired this week. The hackers claimed an Oracle software flaw that experts highlighted in June. No source confirms the real entry point, or whether both accounts describe the same weakness.
A patch is a fix for a known flaw, and until it is installed the flaw stays open. In the FBI's reported account, one missed update on a contractor's system led to the breach. If the hackers are right, the Oracle flaw had been public since June. Buyers can ask vendors how fast they patch and how they would tell you of a miss.