A suspected leader of the notorious ShinyHunters cybercrime operation has been arrested in the Netherlands during a coordinated investigation involving the FBI and Dutch authorities. The international probe is focused on a hacking network blamed for major attacks in the United States and other countries.
Dutch police said Sept. 15 that they had detained a 24-year-old man from Amsterdam over his alleged connection to ShinyHunters and suspected efforts to encourage two murders. Investigators are examining electronic devices seized during the operation, and additional arrests have not been ruled out.
“This morning @FBI and our partners the Dutch National Police are announcing the arrest of one of the alleged leaders of ShinyHunters – a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world,” FBI Director Kash Patel wrote Tuesday on X.
FBI Director Kash Patel says “FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation.” (Anna Moneymaker/Getty Images; Graeme Sloan/Bloomberg via Getty Images)
Patel said the Dutch High-Tech Crime Unit made the arrest under Dutch law in cooperation with FBI investigators. He added that FBI teams were pursuing additional leads tied to the suspect and emphasized that the investigation remains active.
“Thank you to our Dutch National Police partners for their continued work with us in this case and the industry partners who shared information with us. The investigation continues,” Patel said.
Dutch police also said the suspect is believed to have attempted to incite two murders. Authorities seized multiple data-storage devices and are continuing to analyze their contents, warning that more arrests could follow.
Brett Leatherman, assistant director of the FBI’s Cyber Division, had previously issued an unusually direct public warning to ShinyHunters, telling members of the hacking group that authorities knew how to track them down.
ShinyHunters listed Florida’s Department of Motor Vehicles on its leak site and threatened to publish allegedly stolen files if the agency did not respond. (BleepingComputer)
“You know how to find us, and we know how to find you,” Leatherman said in a video message. “I suggest you reach out first while the choice is still yours.”
DON’T MISS: George Clooney’s Heartfelt Notes to Presley Gerber, His “Second Son”
Benjamin Korper, who works for Amsterdam-based cybersecurity firm Neo Security, identified the arrested suspect as Pepijn van der Stap, the company’s offensive security lead.
Korper told Reuters by phone that Dutch forensic investigators searched the company’s office on Sept. 15, the same night Van der Stap was arrested in a dramatic raid involving flash-bang grenades.
ShinyHunters has become known for high-profile data breaches and extortion campaigns. The group recently claimed it had stolen terabytes of sensitive personnel information from FBI servers, including employee medical records and intelligence-related assignments, Reuters reported.
According to a source cited by Reuters, an internal FBI memo told employees the bureau was assuming that hackers may have obtained information connected to its entire workforce.
In a statement, ShinyHunters denied having any connection to Van der Stap and criticized Dutch police as incompetent.
The arrest quickly sent shock waves through the cybersecurity community.
Van der Stap had already drawn public attention after being convicted in 2023 of data theft and extortion, followed by his stated rejection of cybercrime. On his personal website, he wrote that his path “hasn’t been a straight line,” but said the experience taught him that “knowledge is for building and protecting, not breaking.”
Korper said Neo Security conducted extensive checks before hiring Van der Stap and continued monitoring him during his employment. He said the arrest came as a shock.
“I truly believe that people deserve a second chance, but in this case I was not thanked for it,” Korper said. “Absolutely everybody I talked to is flabbergasted.”
Korper said he brought in an independent firm to determine whether Van der Stap had compromised Neo Security or any of its customers. So far, investigators have found no evidence that he carried out attacks against the company or its clients.
Korper and Van der Stap have not been in touch since the arrest, Korper said.
