FBI tells ShinyHunters members to surrender after Dutch arrest

The FBI has warned remaining members of the ShinyHunters extortion group to turn themselves in, following the arrest by Dutch police of a 24-year-old man from Amsterdam on 15 September. Brett Leatherman, assistant director of the FBI's Cyber Division, delivered the message in a video released on Tuesday. Dutch police described the suspect as one of the group's alleged leaders and said he is suspected of participating in a criminal organisation.theregister.com+1

The warning matters because it marks a public shift in how the FBI addresses the group, coming shortly after ShinyHunters claimed responsibility for breaching the bureau's own systems. Leatherman told the remaining members that investigators are actively gathering information about them. The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organisations since last year and collected at least $70 million in extortion payments.

What the FBI video said

In the video, Leatherman addressed the group directly: "You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not." He added that "Other groups believed anonymity, or their friends, would protect them, and they were wrong." The FBI declined to answer questions about whether it had seized any of the group's infrastructure.

Dutch police said a large amount of information was found on the suspect's laptop after his arrest on 15 September, including details about two murders that were to be committed abroad. Police stated there are indications the suspect gave the order for these. The suspect is also suspected of attempted incitement to commit two murders. The Rotterdam District Court ruled on Tuesday that he will remain in pre-trial detention for at least 90 days.bbc.co.uk

What police found on the laptop

The suspect was arrested on 15 September, before the alleged FBI attack took place. Dutch police clarified on Tuesday that the arrest was not part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido. Stan Duijf, who leads Dutch investigations into cybercrime, said the ShinyHunters group is responsible for a large number of national and international victims, and that it is good a suspect has been arrested.

ShinyHunters claimed to have breached the FBI's servers on 21 September and began contacting reporters the next day with samples and screenshots. The group claimed to have stolen between two and three terabytes of data from FBI systems and later provided a sample of about 5,000 FBI personnel records.

The group's own FBI breach claims

The group claimed to have found a vulnerability in the Oracle cloud storage system used by the FBI to breach multiple systems including FBIJOBS, FBI BEAST, FBI MedLink, and FBI BICS. ShinyHunters said the attack was "NOT financially motivated" and said it wanted the FBI to correct or retract statements it made. A spokesperson said: "We are just protecting our business as any other business would do."

The FBI's May advisory described ShinyHunters as threat actors who often use real or exaggerated claims of access to sensitive information to prompt payment from victims. The group said it was offended by this characterisation and asked the agency to retract it. FBI Director Kash Patel said on X that FBI teams are actively working with partners to obtain and execute more leads based on the arrest.

What happens next

Dutch officials have not ruled out further arrests, and police said more arrests are possible. The FBI is continuing to gather information about those involved with the group. Leatherman urged members to reach out first while the choice is still theirs, saying investigators know how to find them. The suspect will remain in pre-trial detention for at least another 90 days following the court's Tuesday ruling.