ShinyHunters: the official record was 105 words on 28 September. On 29 September the Dutch police published a full statement

Update, 7 October: a former Boeing unit is reported as another extortion target, and its statement is narrower than the report

On 7 October KrebsOnSecurity reported that, according to two sources it does not name, a navigation and digital aviation unit that Boeing divested was among the victims the group was in the process of extorting when the Jordanian detention described in the 3 October update took place, and that the FBI's inquiry gained renewed urgency from it. The sources, again as Krebs reports them, said the stolen information could pose operational safety and security risks. I read the Krebs article at about 17:45 BST. I have not seen any of the sources' material, and this briefing names no individual from that report.

What the 7 October report establishes and what it does not. Source: KrebsOnSecurity, 7 October 2026, read at about 17:45 BST; the two company statements are as Krebs quotes them, not read from either company

Item	On the record	Not stated
The victim	Krebs: the incident concerns the former Boeing subsidiary Jeppesen ForeFlight, which Krebs says Boeing sold in November 2025. Two unnamed sources say it was among those being extorted	Any statement from the group about it, any sample, any count of records, what the data is
Boeing	A Boeing spokesperson, quoted by Krebs: Boeing is "aware of claims by a threat actor" about data allegedly associated with Boeing and its former subsidiary, and is "actively reviewing the matter" with the unit	That any data was stolen. The quoted statement says claims and "allegedly"; Krebs's summary sentence says more than the words he prints
The unit	A spokesperson for the unit, as quoted by Krebs: its investigation to date found "no impact to our operations or products"	Whether data left the unit's systems. A statement about operations is not a statement about stolen data
The risk claim	Two unnamed sources say the information could pose operational safety and security risks	Any description of the data. The unit's quoted statement does not address it

Two points follow. First, this is a clear case for the ladder of claims in the section on claimed, acknowledged and sampled. Boeing, as quoted, has acknowledged claims, not a theft, and Krebs's summary sentence, which says Boeing acknowledged extortion attempts and data stolen from the unit, goes a step beyond the words he prints. The unit's statement is about operations and products, which a data theft does not necessarily touch, so the two statements do not contradict each other and neither confirms a loss. Second, Krebs does not say how the unit's data was reached or whether PeopleSoft was involved, and nothing else I read for this update does either. Nothing else in this briefing changes: the 6 October account of a contractor's missed patch is unaffected, and the group's brand and its extortion channel are described in the earlier updates.

Update, 6 October: the FBI says a contractor failed to apply a patch to a third-party platform

On 6 October Reuters reported, from two people familiar with the matter, that the FBI has removed an Accenture contractor over its alleged role in the breach of the bureau's jobs portal. As The Hacker News relays it, an FBI Cyber Division assistant director told Reuters that the bureau's review found the incident was the result of "a security failure" of a platform managed by "a third-party organization", after a contractor "failed to implement a security patch" that had been "explicitly issued". The same quotation says the FBI "has removed the contractor". The FBI did not name the platform. Reuters, per The Hacker News, says it is Oracle PeopleSoft, and Accenture told Reuters it was "proud to support the mission of the FBI". I could not read Reuters: its page answers automated readers with a script check, and I did not try to get round it. Everything here comes through The Hacker News, read at about 14:40 BST on 6 October, and by about 21:00 BST SecurityWeek and DataBreaches.net carried the same quotation, both citing Reuters, SecurityWeek describing it as a statement by the FBI's cyber chief. That is more outlets for one source, not a second source. I found no FBI page. The rest of the briefing is the record as it stood on 28 September, with the 29 September and 3 October updates; where a sentence has been overtaken, it now says so.

What the 6 October report establishes and what it does not. Source: Reuters as relayed by The Hacker News, 6 October 2026; read at about 14:40 BST; nothing here is read from Reuters or the FBI directly

Item	On the record	Not stated
The cause	FBI statement, as quoted: a third-party platform failed after a contractor did not apply a security patch that had been issued	Which patch, which product (the FBI named none), when the patch was issued, how long it stayed unapplied, or whether it is the one for CVE-2026-35273 that earlier updates discuss
The contractor	Removed by the FBI, per the FBI quotation. Reuters's two sources and The Hacker News name Accenture; the company says it is proud to support the FBI	What the contract covered, whether the contractor operated the platform or only managed its patching, any dispute about fault
The platform	Reuters, per The Hacker News: Oracle PeopleSoft. The group says it used PeopleSoft	Any FBI confirmation of the product. Any statement from Oracle
Scope	Nothing new. The FBI's 23 September text still says only "alleged impact" on employee personal data	Records taken, number of people, whether the FBI confirms the group's figures

Three cautions. The quotation is second-hand and trimmed to fragments; the full FBI wording may differ in ways that matter, and the FBI's own site is the place to check. A contractor's missed patch is the FBI's account of a cause, not a finding by anyone else, and it does not say the group's other claims are true or false. And it does not close the question this briefing began with, because it says why the portal was open, not what was taken. It does change one sentence the briefing had to leave open: on 23 September the FBI would not say whether the point of breach was a third party or its own enterprise, and on 6 October, if the quotation is accurate, it says a third party's platform. For a defender the checklist below is unchanged, and its first item (find every PeopleSoft instance, including those a supplier runs for you) now has an official example behind it: the question of who is responsible for applying a patch to a platform you depend on was the one that decided this case.

Update, 3 October: Reuters reports a second detention, in Jordan, from anonymous sources

On 3 October Reuters reported, from three people familiar with the matter, that a suspected ShinyHunters member was detained by Jordanian authorities this week and is cooperating with the FBI. Two of the sources said he was taken into custody on Tuesday, which was 29 September. If it is accurate, it is a second detention in this inquiry, after the Dutch arrest of 15 September described in the update below. This briefing does not name him: no authority has named him, and the report rests on unnamed sources. I read Reuters' text as syndicated by US News and the BleepingComputer report that relays it, at about 20:45 BST on 3 October. The rest of the briefing is the record as it stood on 28 September, with the 29 September update; where a sentence has been overtaken, it now says so.

What the 3 October reports establish and what they do not. Source: Reuters (syndicated by US News) and BleepingComputer, 3 October 2026; read at about 20:45 BST

Item	On the record	Not stated
The detention	Reuters: three people familiar with the matter say a suspected member was detained by Jordanian authorities; two say Tuesday 29 September	Any Jordanian or FBI confirmation. Reuters says it could not determine the circumstances or where he is held
Cooperation	Two of the sources say he is helping the FBI and other agencies find the group's other members; one says he is going through his devices and messages	What has been handed over, whether it is reliable, any agreement or charge
The FBI's position	Declined to comment on any specific arrest or activity abroad. Said it "continues to aggressively investigate" and has "already worked with partners to arrest multiple subjects". The director posted on 30 September that "More arrests are on the table"	Who the multiple subjects are beyond the 15 September Dutch arrest, or how many
The group's signs	From Tuesday the account used to reach journalists went quiet. By Wednesday the dark web site had gone (Reuters). A new leak site appeared on Thursday (BleepingComputer). An email to Reuters said "we want no further escalation" with the FBI	Whether any of this is connected to the detention. BleepingComputer says that is unclear

Three cautions. A detention reported by anonymous sources is the sources' account, not an authority's, and neither report quotes a Jordanian statement. "Cooperating" and "helping" are the sources' words and say nothing about what has been shared or how far it can be relied on. And a detention is not a charge: the ladder of claims in this briefing applies to it as it does to the Dutch arrest. For a defender nothing changes in the checklist below. The group's new leak site means the extortion channel was still open on Thursday, whoever is in custody, and the briefing's advice about the PeopleSoft portal and the 72-hour notification clock stands.

Update, 29 September, 15:45: the Dutch police published a full statement

At 15:45 on 29 September the Dutch police published a full statement on politie.nl, which I have read in the original Dutch (translations here are mine). It answers most of what this briefing listed as not stated on 28 September, and it adds a suspicion that the police say is separate from the hacking inquiry. The rest of the briefing is the record as it stood on 28 September. Where a sentence has been overtaken, it now says so.

What changed between the police post of 28 September and the police statement of 29 September. Source: politie.nl, 29 September 2026, translation mine; the police name no one

Question	28 September	29 September, politie.nl
Arrest date	"This month". Press said 15 September.	Tuesday 15 September.
What he is suspected of	"An investigation into" ShinyHunters.	A role within ShinyHunters, and taking part in a criminal organisation, for which he was arrested. Separately, attempted incitement of two murders abroad, which the police say is separate from the ShinyHunters investigation.
Custody	Rotterdam court chamber due on 29 September.	The chamber ruled that he stays in pre-trial detention for at least 90 more days. He is held with all restrictions.
The Odido breach	Not mentioned.	He was not arrested in the Odido investigation. The police are still looking for more leads in it. They also describe ShinyHunters as involved in breaches such as Odido, Pornhub and Ticketmaster.
Evidence	Not stated.	Several data carriers seized. Information on his laptop included two murders to be committed abroad, and the police say there are indications he gave the order. Further arrests are not ruled out.
His name	Not stated.	Not stated. Some outlets have published a name. This briefing does not.

Three cautions still apply. A suspicion (verdenking) is not a charge, and the murder-incitement suspicion is the police's own account of what they found on a laptop, not a finding. The police statement does not mention the FBI portal, so nothing official links the arrest to that claim. And the group told The Register that the arrested person "has no association with us", which is the group's claim, in the same voice as its FBI claim. The Register also reports that the FBI director said the bureau helped the Dutch investigators; the police statement does not say so.

105 words, and what they leave out

This is the record as it stood on 28 September; the updates above cover 29 September, 3 October and 6 October. The Dutch police and the FBI each put out one short statement about ShinyHunters this week. The police one, posted on X on 28 September, is 40 words. The FBI's, published on fbi.gov on 23 September, is 65. That is 105 official words, counted for this briefing: hyphenated words count once and a long dash counts as a word break.

They are narrower than the coverage around them. The police say a 24-year-old man from Amsterdam was arrested this month "in an investigation into" the hacker group (my translation of the Dutch). The FBI says it is aware of a group "claiming a compromise" of the fbijobs.gov portal, with "alleged impact" on employee personal data. Neither text gives a name, a charge, a quantity of stolen data or a method. The FBI's 65 words contain no figure, no system name, and neither the word "confirmed" nor the word "stolen".

Everything else this week is reporting from unnamed sources, or the group speaking for itself: the suspect's name, the 2 to 3 TB, the 60,000 people, the motive, the internal feud. This briefing keeps the three apart, because a defender who blends them will either panic on a claim or relax on an arrest. It builds on two earlier pieces about the same group, the Grav flaw behind the Clop leak site defacement and the PeopleSoft firewall bypass, and does not repeat them.

The two official statements: the Dutch police post on X of 28 September (translation mine) and the FBI press release of 23 September

Statement	On the record	Not stated
Dutch police, national investigations unit, X, 28 September (40 words)	A 24-year-old man from Amsterdam was arrested this month in an investigation into ShinyHunters. He was to appear before the raadkamer of the Rotterdam court on 29 September. More information was promised for that day, and arrived at 15:45 (see the update above).	His name. The charge. The arrest date. Whether he is a member and what he is suspected of doing. Any link to the Odido breach or to the FBI matter.
FBI, fbi.gov, 23 September (65 words)	Aware of a group claiming a compromise of the fbijobs.gov portal and alleged impact on employee personal data. Point of breach undetermined: a third party or the FBI's own enterprise. Investigating with the portal's third-party providers.	That data was taken. How much, whose, from which systems. How the intruder got in. Anything about the group's other claims.

Two things follow at once. An official silence is not a denial: the FBI says it is "actively and aggressively investigating", and the Dutch police have promised more information on 29 September. But an official silence is not a confirmation either. Where the record is thin, the honest label is "not stated", and each table in this briefing keeps a column for it.

I checked politie.nl and the Public Prosecution Service's news page on the morning of 29 September and did not find the follow-up the police promised for that day. If it has appeared since, it supersedes what this briefing says about the arrest.

Each development can be written as a ladder of claims, from the cheapest to establish at the top to the most expensive at the bottom. The evidence on both stories reaches about the same height: something happened, the authorities acknowledge it, and then the rungs that would settle the question are empty, pending, or held by a party with an interest.

Zoom

An arrest is a step in a procedure, not a finding

The Dutch judiciary describes what happens next in plain terms. Pre-trial detention (voorlopige hechtenis) means the suspect is held while waiting for the judge's decision in the criminal case. It has two phases: bewaring, ordered by an investigating judge for up to 14 days, and then gevangenhouding, which the prosecutor asks the court to order. On 29 September the raadkamer of the Rotterdam court decided that he stays in custody for at least 90 more days, according to the police statement of that afternoon. Among the tests the judiciary lists is that the suspicion against him must be solid ("stevig"). Solid suspicion is a threshold for holding someone. It is not a finding of guilt, and if a court later acquits, the detention ends.

On 28 September the police had not said what he is suspected of; on 29 September they did, as set out above. They still have not named him. Dutch and international outlets, citing unnamed sources, have named a man. This briefing does not repeat the name, because the police have not published it and no court has found anything against him.

Three things the statement does not carry, and which the surrounding coverage tends to fill in:

• The Odido link. On 28 September the police post did not mention Odido; on 29 September the police said he was not arrested in the Odido investigation. On 7 September the police published the voice of a man suspected in the Odido hack, a caller who posed as an IT colleague and got an employee to enter credentials and a verification code on a fake login page. The group then told Dutch media the man in that recording is one of its members. No official source says the arrested man is that caller, and the report, relayed by BleepingComputer, that people who know him doubt the voice matches is third-hand and untested.
• The FBI link. The arrest was in September and the FBI claim followed within days. That is a sequence, and nothing the police have said ties the two. KrebsOnSecurity, citing unnamed sources, offers a story about a feud over control of the group's brand. The group offers a story about retaliation. Neither is on any official record.
• The denial. The group told BleepingComputer the arrested man has "no association with us", and told Dutch media much the same. That denial comes from the same voice that claims the FBI breach. Either both statements are evidence or neither is, and I treat both as claims.

Does one arrest touch the group? Nothing official gives the group's size. BleepingComputer wrote in 2025 that ShinyHunters was believed to be several actors operating under one name, and reported, citing Le Parisien, that French police had arrested four people in June of that year, one of them using the ShinyHunters handle. That was more than a year before this arrest, and the group's 2026 activity since is what this week's stories are about. The group itself told The Register that it has seen the "majority" of GnosticPlayers members arrested, the name it says it used before 2020. That is a self-description, unverified, and no more than that.

The arrest date was reported as 15 September, from BleepingComputer citing DataBreaches and from a Reuters interview relayed by the Dutch news agency ANP. On 28 September the police said only "this month", and KrebsOnSecurity's sources said on or around 16 September. On 29 September the police confirmed Tuesday 15 September. Counting from the reported date: the Clop leak site was defaced on 18 September (day 3, attributed to ShinyHunters in the earlier Grav briefing). The group says it entered the FBI portal on the Monday night, 21 September (day 6), and went to the press on 22 September (day 7). Mandiant published its report of renewed mass exploitation on 25 September (day 10). Every day count here is derived, from a date that the police have since confirmed.

Those counts show that the group's public activity did not pause. They do not show that the arrest made no difference, or that the same people did all of it.

What the Dutch police statements (X, 28 September; politie.nl, 29 September) and the judiciary's description of pre-trial detention support

The arrest establishes	It does not establish
Dutch police arrested a 24-year-old man from Amsterdam on 15 September on suspicion of a role in ShinyHunters and of taking part in a criminal organisation.	That he is a member, or what he did.
A court chamber in Rotterdam ruled on 29 September that he stays in pre-trial detention for at least 90 more days.	That he has been charged with, or convicted of, anything in this case.
The police also suspect him of attempted incitement of two murders abroad, and say that suspicion is separate from the ShinyHunters investigation.	That the murder suspicion has anything to do with hacking. It is a suspicion, not a finding.
The suspect was not arrested in the Odido investigation.	That the arrest relates to the FBI portal. Neither statement connects them.
Nothing more than that.	That the group is smaller, slower or disrupted.
Nothing more than that.	That the FBI claim is true, or false.

Fifteen days, and who vouches for each step

The diagram puts the fifteen days on one axis and colours each event by who is vouching for it. The colours matter more than the dates. An event vouched for by an authority is a different kind of fact from one vouched for by the group that benefits from being believed.

The group's own deadline for the FBI is drawn hollow because it is derived. BleepingComputer and the BBC report that the group gave the bureau one week to correct or remove its May advisory. The BBC adds that the group would otherwise publish the data; BleepingComputer reports that when asked, the group declined to say whether it would. One week from 22 September is 29 September, and a later BBC report of "five days" points to 30 September. I did not read the group's statement, so the deadline rests on those reports. If data appears after this briefing is published, it will not be linked from here.

Zoom

Claimed, acknowledged, sampled: three different things

On 22 September the group told BleepingComputer and The Register that it had entered the FBI's jobs site the previous night through a PeopleSoft flaw, moved onto FBI-managed servers in AWS GovCloud, and taken 2 to 3 TB. It told 404 Media it held data on "all FBI employees and applicants". That is a claim. The same day the FBI told BleepingComputer it was "aware of claims regarding unauthorized activity" affecting the portal and "currently investigating". That is an acknowledgement of an investigation. On 23 September it published the longer statement quoted above.

Outlets then read those words in several different ways.

How outlets described the same FBI wording (The Register and the BBC, 25 September; BleepingComputer, 26 September; KrebsOnSecurity, 28 September)

Outlet	What it wrote about the FBI
The Register	The FBI "confirmed the breach" to the outlet.
The BBC, body text	The FBI "acknowledged the breach" on the Wednesday.
The BBC, headline	Test results "stolen in FBI hack". The body text says the criminals "say they have" the data.
KrebsOnSecurity	The FBI issued a brief statement "confirming the hack".
BleepingComputer	The FBI did not confirm its systems were breached or that data was stolen.

The FBI's text says it is aware of a group "claiming a compromise", of "alleged impact", and that "the point of breach is still undetermined". The strongest phrase in it is "point of breach", which treats a breach of something as the working assumption while leaving open whether it was "a third-party or the FBI's enterprise". That is more than a bare "we are aware of claims". It is still not a statement that data was taken, how much, or whose. Reasonable readers differ. BleepingComputer's reading is the most literal and the Register's the most generous. For anything you would put in a board paper, quote the literal one. (The FBI's original text uses dashes, so the phrases are quoted separately here.) That is the 23 September text. On 6 October the FBI is quoted saying more about cause: see the update at the top.

The same table exercise works on the group's own claims, one row at a time.

What the group claims, what the FBI has stated about each item, and what others have checked, as of 29 September

The group claims	The FBI has stated	Checked by others
Entry through a PeopleSoft flaw on the jobs site.	A compromise is claimed. Point of breach undetermined: third party or FBI enterprise.	Mandiant's 25 September report does not mention the FBI. The group told BleepingComputer on 26 September that it used the firewall bypass Mandiant describes, and still claims a second, new bug in the same component.
2 to 3 TB taken from FBI-managed servers on AWS GovCloud.	Nothing.	Nothing found.
Data on all employees and applicants, later about 60,000 current and former staff.	Nothing on scope.	The BBC gives the bureau's staff as about 38,000. 404 Media's sample held about 5,000 records, per BleepingComputer.
Sample records with home addresses, phone numbers and medical examination details.	Alleged impact on employee personal data.	The BBC says samples shared with journalists "appear genuine". 404 Media told BleepingComputer some details were accurate. Reuters examined documents, per KrebsOnSecurity.
Access to HR, medical, criminal justice and investigative systems.	Nothing.	Nothing found beyond the group's own list.

The samples matter. Several outlets that examined them say they appear genuine, which is real evidence that some authentic personal data is in the group's hands. It is not evidence of where it came from. On 23 September the FBI did not say whether the point of breach was a supplier or its own systems; on 6 October it is quoted saying a third party's platform (see the update at the top). A jobs portal run by a supplier can hold a great deal of real personal data without touching an investigative system. The BBC describes fitness-for-work medical records among the samples it saw. That fits a claim of HR-side data, and by itself does not show access to investigative systems. That last step is my inference, not a finding.

The scale moved too. On 22 September the claim was 2 to 3 TB and data on all employees and applicants. By 25 September the BBC reported that the group said it had underestimated and now claimed about 60,000 current and former staff. Claimed scope rose. Confirmed scope did not change, because none has been stated.

One thing I could check myself. At about 10:15 UTC on 29 September, a plain request to apply.fbijobs.gov, the address named in the claim, was answered with a redirect to the fbi.gov home page. The Register saw a maintenance message on 22 September and reported the portal still down on 25 September. That says the portal is not serving as normal. It says nothing about why, or about what was taken.

The entry method moved as well. On 22 September the group said a new, unpatched PeopleSoft zero-day. On 25 September it told The Register the flaw still had no patch. On 26 September it told BleepingComputer it had used the encoded-path bypass against FBI Jobs, while still claiming a new flaw in the same component. KrebsOnSecurity on 28 September says the group named CVE-2026-35273, the flaw Oracle patched on 10 June.

If the later account is right, the FBI's jobs portal, or its provider, is the case in the earlier briefing: a path-based mitigation standing in for a patch, 104 days after Oracle's fix (10 June to 22 September, derived). If the earlier account is right, there is an unpatched flaw in a widely used product. Only Oracle, the FBI or the portal's provider can say which. None has, in anything I read, and The Register reported that Oracle had not responded.

What a stated motive tells a defender

The headline motive is the group's: "This is NOT financially motivated", it told The Register on 22 September. Three days later it told the same outlet: "We are just protecting our business as any other business would do." It called the FBI intrusion "fundamentally a public relations and marketing initiative for our business". It said it expects "future corporate partners we engage with for payment" to read the documentation and take the group for "serious, results-driven professionals".

The Register's own gloss is that most people call those partners victims. The BBC reports that the group is not asking the FBI for money but for a retraction, and says the group would otherwise publish. BleepingComputer reports that the group declined to say. The group says the demand is not extortion. Whether it is, is a matter for prosecutors and makes no difference to a defender.

A comforting label is not a control. "Not financially motivated" sounds like lower risk. By the group's own account it describes what was asked of the FBI, not the business the intrusion advertises. The group's picture of itself as "professional and predictable" is also marketing, and nobody should price a risk on a self-description. I take these words as a record of what the group says, not of what is so.

What the group's stated motive tells a defender, and what it does not

It does tell you	It does not tell you
The group needs its claims believed. It says so: bringing a corporate to the table takes "a lot of convincing" if the company thinks it is being bluffed.	Whether any given claim, including this one, is exaggerated. The FBI's May advisory warns of "real or exaggerated claims of access".
By the group's account, a public statement about it can draw a response. The FBI's May advisory is the stated cause.	That this is a pattern. It is one incident, and the account is the group's.
The FBI intrusion was, in the group's words, advertising aimed at future victims.	Which victims are next. "Protect our business" is not a filter on targets.
That the group is willing to talk to journalists at length, which gives you claims to test.	How it got in. Technique evidence is Mandiant's, and covers dozens of systems in seven sectors, government among them.

Method belongs apart from accusation. The FBI's May advisory is an assertion about the group's tactics: harassment of victims and their families, swatting, and false claims of compromising material. The group denies it. Neither side has published evidence for or against in anything I read, and this briefing takes no position on that dispute. It matters here for one reason. It is the group's stated reason for the FBI intrusion, and a defender should note that the reason is a dispute about credibility.

Two interests to state without sneering. Mandiant sells incident response, so its post is a primary source on technique and is silent on the FBI. And every outlet quoted here gained an exclusive by carrying the group's words, which also serves the group's stated purpose. That is a reason to read the quotes as statements, not findings.

The defender's conclusion is narrower and more useful. A claim about your data is a hypothesis with a cost to test, made by a party who gains if you believe it. Both errors are expensive: acting on a bluff and ignoring a real theft. What separates them is your own evidence, not the claimant's confidence and not a stranger's assessment of its motive.

What to do about it

Nothing in the Dutch statement changes a technical control, and the FBI's 23 September text does not say how anyone got in (the 6 October statement says only that a contractor did not apply a patch to a third-party platform). So this list does not wait for either. The legal point in the fourth item is general guidance, not legal advice, and it draws on the ICO's breach guide and the Article 29 Working Party guidelines it points to.

The question this leaves

On 23 September the FBI said it did not yet know whether the point of breach was a third-party provider or its own enterprise. On 3 October it declined to comment on any specific arrest, saying only that it has "already worked with partners to arrest multiple subjects". On 6 October, as quoted by Reuters and relayed by The Hacker News, it said a contractor had failed to apply a security patch to a third party's platform and had been removed. An agency with a full investigative arm took 13 days to move from not knowing whose platform was the entry point to saying who had not patched it (derived from 23 September to 6 October), and I have the second statement only second-hand.

So the question is for your own estate. If your careers portal were named on a leak site this afternoon, could you say by tonight whether the point of breach was yours or a supplier's, and who would have to answer for the answer?