Overview
The FBI said Dutch police have arrested an alleged leader of ShinyHunters, the cybercrime group linked to more than 140 organizational breaches and at least $70 mn in extortion payments since 2025.
Dutch police arrested the 24-year-old Amsterdam resident on Sept. 15 as part of an investigation into ShinyHunters, although authorities announced details of the case later in September.
FBI Director Kash Patel described the suspect as one of the group’s alleged leaders and said U.S. investigators were continuing to pursue additional leads with Dutch authorities.
The arrest comes after ShinyHunters claimed responsibility for compromising FBIJobs.gov and obtaining sensitive information concerning FBI personnel and job applicants. The FBI has been investigating the breach, while Reuters reported that an internal bureau memo instructed officials to operate on the assumption that current and former employees had been exposed.
FBI warns remaining ShinyHunters members
Brett Leatherman, assistant director of the FBI’s Cyber Division, issued a direct warning to remaining members of ShinyHunters following the arrest.
“You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours,” Leatherman said in a video address.
He said other cybercrime groups had previously believed anonymity or associates would protect them from law enforcement, but arrests and seizures often give investigators additional information about other participants.
According to Leatherman, the arrested suspect and alleged co-conspirators have breached more than 140 organizations since last year and received at least $70 mn in extortion payments.
ShinyHunters has been associated with attacks targeting third-party vendors and cloud-based platforms, where stolen information is later used to pressure victims into paying ransom or extortion demands.
The group has continued operating across several sectors. Google’s Mandiant recently linked ShinyHunters activity to attacks exploiting Oracle PeopleSoft systems used by organizations in education, healthcare, government and technology.
FBI breach exposed sensitive personnel data
ShinyHunters claimed in September that it had compromised the FBI’s employment systems and stolen data relating to bureau employees and applicants. Reuters reviewed portions of the material and reported that exposed records included names, personal identifiers and information about assignments involving counterintelligence and other sensitive work.
The hackers later claimed they had obtained additional medical and psychiatric records belonging to FBI personnel. Reuters reviewed some documents containing clinical and employment-related information but wasn’t able to authenticate the full volume of data claimed by the group.
Officials haven’t publicly explained how ShinyHunters gained access to FBIJobs.gov. The FBI has described the investigation as active, and Patel said teams were working with international partners to develop and execute further leads following the Dutch arrest.
Dutch suspect also investigated over alleged murder solicitation
Dutch police haven’t publicly named the arrested man. They said he is a 24-year-old Amsterdam resident suspected of playing a role within ShinyHunters, and investigators seized several data-storage devices for examination. Police said further arrests remain possible.
Dutch authorities are separately investigating the suspect for allegedly attempting to solicit two murders. Police said information related to those allegations was found during the investigation, but the suspected murder solicitation isn’t connected to the ShinyHunters case.
Reuters reported that Benjamin Korper, head of Amsterdam cybersecurity company Neo Security, identified the suspect as Pepijn van der Stap, who worked there as an offensive security specialist. Dutch authorities themselves haven’t publicly confirmed the suspect’s identity.
A Rotterdam court ordered the suspect to remain in custody for another 90 days while the investigation continues.
ShinyHunters remains under investigation
The arrest doesn’t close the wider investigation into ShinyHunters. Dutch police are examining seized devices, while the FBI is pursuing other individuals and infrastructure associated with the group.
Leatherman said arrests and infrastructure seizures often expose additional participants in cybercrime operations. His message to remaining ShinyHunters members was unusually direct, coming days after the group publicly claimed responsibility for one of the most serious recent breaches involving FBI personnel information.
