Dutch police arrest ShinyHunters suspect held over 90 days

Dutch police arrested a 24-year-old man from Amsterdam on 15 September on suspicion of taking part in the ShinyHunters cybercriminal group, and a Rotterdam court on Tuesday ordered him held for a further 90 days. The FBI and Dutch authorities say ShinyHunters is linked to hacks on more than 140 organisations worldwide.cbsnews.com

The arrest and the 90-day order

The arrest matters because the FBI and Dutch law enforcement tie the group to a claimed breach of the FBI's own jobs website, and because police say the suspect's laptop held material about two murders to be committed abroad. The murder inquiry is separate from the ShinyHunters case, Dutch police said.techcrunch.com

What the arrest changes

Brett Leathermann, the FBI's cyber division lead, said in a video message on Tuesday that Dutch authorities had arrested one of the "alleged leaders of ShinyHunters." He added that the Dutch High Tech Crime Unit "moved quickly to protect victims and preserve critical evidence," and vowed the bureau would go after the rest of the hackers.theregister.com

FBI Director Kash Patel wrote on X that the FBI and the Dutch National Police were announcing the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands and worldwide. He said FBI teams were working with partners to obtain and execute more leads.independent.co.uk

Where the laptop evidence came from

Dutch police confirmed an unnamed 24-year-old Amsterdam man was arrested under Dutch law on 15 September and was scheduled to appear in court on Tuesday. Officers have not named the suspect. Police said the arrest was for "participating in a criminal organization," referring to ShinyHunters. After seizing his devices, police said "a lot of information was found on his laptop, including about two murders that should be committed abroad." The man is also being investigated for attempting to orchestrate those murders, and Dutch authorities said this is separate from the ShinyHunters investigation. Police said there are indications the suspect gave the order.

The remand and the murder probe

ShinyHunters is accused of hacking companies to steal data and threatening to publish it unless victims pay a ransom. Dutch authorities said the gang is accused of breaches at Pornhub, Ticketmaster and AT&T, and the group claimed a breach of Dutch provider Odido affecting 6.2 million customers. Police said the arrested man is not held over the Odido hack.

The suspect was remanded for at least 90 days after his Rotterdam hearing on Tuesday, and police said he is being held in complete isolation while investigators work the two cases. Stan Duijf, the Dutch police official responsible for tackling cybercrime, said ShinyHunters "is responsible for a large number of victims, both in the Netherlands and abroad."

The FBI has not publicly confirmed a breach. ShinyHunters said it took personal and sensitive data belonging to "mostly all" of the FBI's agents and applicants by breaching its careers website, and gave the bureau one week to correct a May advisory; that timeframe expired on Tuesday. The group later said it had no plans to publish the data.

A representative of the ShinyHunters group said that the man named in reporting "has no association with us," and the group said the same. Media outlets have named the man as Pepijn van der Stap, identified in 2024 as a cybersecurity researcher who also worked as a criminal hacker.

Dutch broadcaster RTL and other outlets have published a name, but police continue to withhold it. Authorities have not said whether the suspect took part in the Odido attack or is the caller in an audio recording released on 8 September, after which police received 20 tips. Dutch detectives seized data storage devices and did not rule out more arrests.