• Wion
  • /World
  • /FBI strikes back at ShinyHunters after alleged hack, arrests leader in Netherlands, warns members: 'Your anonymity won't protect you'

FBI strikes back at ShinyHunters after alleged hack, arrests leader in Netherlands, warns members: 'Your anonymity won't protect you'

FBI strikes back at ShinyHunters after alleged hack, arrests leader in Netherlands, warns members: 'Your anonymity won't protect you'

FBI Director Kash Patel waves after taking his seat at the start of a Senate Judiciary Committee hearing on FBI oversight, on Capitol Hill in Washington, DC, on September 15, 2026. Photograph: (AFP)

Story highlights

The FBI has arrested a 24-year-old Dutch man identified as an alleged ShinyHunters leader, days after the group claimed to have hacked the agency's employment website. The bureau has warned remaining members as investigators pursue further leads.

Just days after ShinyHunters claimed to have hacked the FBI (Federal Bureau of Investigation) employment website, the American investigative agency has hit back at the hacking group, arresting an alleged leader of the notorious syndicate. In a post on X, FBI Director Kash Patel announced the arrest of "one of the alleged leaders of ShinyHunters – a global cybercrime and threat actor group linked to cyberattacks in the United States". The alleged ShinyHunters leader, identified as 24-year-old Amsterdam man Pepijn van der Stap, was arrested in the Netherlands on September 15 following a joint operation involving the FBI and Dutch authorities.

What we know about the ShinyHunters leader

Dutch police said a 24-year-old man from Amsterdam was arrested on September 15 over his alleged involvement with ShinyHunters. He is also suspected of attempting to incite two murders, according to Dutch authorities.

Add WION as a Preferred Source

Investigators seized multiple electronic devices and said further arrests had not been ruled out.

Suspect identified by cybersecurity executive

Trending Stories

Benjamin Korper, offensive security lead at Amsterdam-based cybersecurity company Neo Security, identified the arrested man as Pepijn van der Stap. Korper told Reuters that Dutch forensic investigators visited his office on September 15, the day Van der Stap was arrested in a police operation involving flash-bang grenades.

The arrest has drawn significant attention in the cybersecurity community because Van der Stap had previously been convicted in 2023 of data theft and extortion. He later publicly distanced himself from cybercrime. On his personal website, he wrote that his experience had taught him that “knowledge is for building and protecting, not breaking.”

Korper said he had thoroughly vetted Van der Stap before hiring him and had monitored his work. He said an external firm was investigating whether the employee had compromised Neo Security or its customers, but no evidence had so far been found showing that he had acted against the company or its clients. “I truly believe that people deserve a second chance, but in this case I was not thanked for it,” Korper said.

FBI warns remaining ShinyHunters members

FBI Director Kash Patel said the arrest was carried out by the Dutch High-Tech Crime Unit in coordination with FBI investigators. “This morning @FBI and our partners the Dutch National Police are announcing the arrest of one of the alleged leaders of ShinyHunters, a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world,” Patel wrote on X.

He said FBI teams were continuing to work with international and industry partners to develop further leads from the investigation. The FBI's Cyber Division also issued a direct warning to members of the group.

‘We know how to find you’

Brett Leatherman, assistant director of the FBI's Cyber Division, told remaining ShinyHunters members that investigators were confident the arrest and seized infrastructure would provide further information about the network.

“Other groups believed anonymity or their friends would protect them, and they were wrong,” Leatherman said. “Arrests have a way of changing who is willing to talk. And seized infrastructure has a way of showing us who's left.”

He added: “The longer you stay in this, the more we learn about you. You know how to find us and we know how find you. I suggest you reach out first while the choice is still yours.”

According to Leatherman, ShinyHunters and its alleged co-conspirators have breached more than 140 organisations since last year and obtained at least $70 million in extortion payments. He said the group often targeted third-party vendors and cloud platforms, stealing sensitive information and threatening to publish it unless victims paid.

ShinyHunters denies connection

ShinyHunters, in a statement cited by Reuters, denied that Van der Stap was associated with the group and criticised Dutch police.

The group has previously been linked to large-scale data theft and extortion attacks. It also recently claimed responsibility for stealing sensitive personnel data from US FBI systems, although the extent of the alleged breach has remained under investigation.

A source cited by Reuters said an internal FBI memo told employees the bureau was operating on the assumption that hackers may have obtained information relating to all FBI employees.

About the Author

Share on twitter

Moohita Kaur Garg

Moohita Kaur Garg is a journalist and Senior Sub-Editor at WION News with five years of experience covering the volatile intersections of geopolitics and global security. She has e...Read More