In a major breakthrough in the global fight against transnational cybercrime, Dutch law enforcement has taken into custody a 24-year-old Amsterdam man suspected of being a core member of the notorious hacking collective ShinyHunters, the group that recently claimed responsibility for stealing sensitive personal data on roughly 38,000 current and former FBI employees.
The arrest, carried out on September 15, actually preceded the group’s public claim of the FBI breach by six days, according to official statements from Dutch police. Beyond his alleged ties to the ShinyHunters network, the suspect faces additional serious charges: attempted incitement to murder and suspicion of ordering two targeted killings planned for execution outside the Netherlands.
Following the arrest, law enforcement seized all of the suspect’s digital devices. Investigators confirmed they discovered a massive cache of data on his laptop, including detailed planning documents linked to the two planned international murders. The suspect has remained in pre-trial detention since he was taken into custody, and Dutch authorities have publicly noted that additional arrests linked to the hacking network may be forthcoming.
Stan Duijf, who heads the Netherlands’ dedicated cybercrime investigation unit, emphasized the significance of the arrest in an official briefing. “The ShinyHunters group is responsible for a large number of national and international victims,” Duijf said. “It is good that we have been able to arrest a suspect in the investigation into this group.”
FBI leadership has moved quickly to praise the collaboration with Dutch partners, with Director Kash Patel confirming on social platform X that investigative teams are already pursuing new leads generated by the arrest. “As we speak, FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” Patel said.
Brett Leatherman, assistant director of the FBI’s Cyber Division, used the arrest as an opportunity to issue a direct appeal to other remaining members of the ShinyHunters network to surrender. “While the choice is still yours,” Leatherman said, urging members to turn themselves in to authorities. He added that many criminal hacking groups have falsely relied on anonymity and perceived loyalty among members to avoid prosecution, but arrests often prompt cooperation that unravels entire networks. “The longer you stay in this, the more we learn about you, you know how to find us, we know how to find you,” he warned.
The high-stakes drama unfolded after ShinyHunters claimed to have breached multiple FBI-connected cloud servers on September 21, reaching out to journalists the following day to share partial samples and screenshots of the stolen data to back up their claim. Reporters from the BBC who reviewed a small subset of the shared data confirmed the documents appeared to be authentic. The group claimed the stolen cache includes every agent’s full name, job role, official badge number, and private personal details such as home addresses and personal phone numbers, covering the full 38,000-person roster of FBI staff.
ShinyHunters is an loosely organized international hacking collective that first emerged on the cybercrime scene with origins traced to France. The group has already gained notoriety for a string of high-profile breaches over the past year, including a major hack of game developer Rockstar Games in April and a disruptive attack on popular global education platform Canvas in May.
In the alleged FBI breach, the group claims it exploited an unpatched security vulnerability in an Oracle cloud storage system used by the agency to gain access to multiple internal platforms. These included the FBIJOBS recruitment portal, the FBI BEAST background check system that vets employees and job applicants, FBI MedLink which stores confidential medical records for agents, and the FBI BICS investigation database.
In a message posted to a dark web forum, ShinyHunters denied they carried out the attack for financial extortion, the group’s typical model for prior breaches. Instead, the collective said it launched the attack to force the FBI to retract a May 2024 public advisory that labeled the group as a malicious cyber threat. ShinyHunters said they were “offended” by how the FBI characterized their activities. That public service advisory, which remains published on the FBI’s official website, describes ShinyHunters as “threat actors who often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims.” It adds that the group “target major companies across tech, finance, and retail, often stealing millions of customer records at once.”