The FBI has issued a direct warning to remaining members of ShinyHunters, urging them to contact authorities following the arrest of a 24-year-old man in the Netherlands whom the bureau describes as one of the cybercrime group’s alleged leaders.
Brett Leatherman, assistant director of the FBI’s Cyber Division, delivered the warning after Dutch authorities publicly confirmed the arrest. He said investigators are continuing to collect information from the operation and suggested that additional members should come forward before law enforcement reaches them first.
“You know how to find us, and we know how to find you,” Leatherman said. He added that arrests can change people’s willingness to cooperate and that seized infrastructure can provide investigators with information about other participants.
The suspect is a 24-year-old Amsterdam resident arrested by Dutch authorities on September 15. Dutch police have not officially named him, although multiple reports have identified him as Pepijn van der Stap, a cybersecurity professional previously convicted of hacking, data theft and extortion offenses.
ShinyHunters has rejected claims that Van der Stap is one of its members, saying he has no association with the group. That denial conflicts with the FBI’s description of the arrested suspect as an alleged ShinyHunters leader, leaving his precise role to be established through the continuing investigation and legal proceedings.
According to the FBI, ShinyHunters and its alleged co-conspirators have compromised more than 140 organizations since last year and collected at least $70 million through extortion. The group commonly targets third-party vendors and cloud-based environments, steals sensitive information, and then pressures victims with threats that the data will be published.
The arrest comes amid heightened scrutiny of ShinyHunters following its claimed intrusion into the FBI’s own systems. The group recently claimed responsibility for compromising FBIJobs.gov and obtaining sensitive information associated with FBI personnel and job applicants. The FBI has acknowledged investigating the incident, but not every claim made by the hackers about the scope of the stolen information has been independently confirmed.
ShinyHunters initially gave the FBI one week to change an advisory describing the group’s activities. The hackers later said the deadline was part of a publicity campaign and claimed they never intended to release or sell the FBI information.
The timing is notable because the Amsterdam suspect was already in custody before ShinyHunters publicly announced the FBI breach. He was arrested on September 15, while the group’s claims concerning FBIJobs.gov emerged several days later.
Dutch authorities have since ordered the suspect to remain detained for another 90 days. Police are analyzing storage devices seized during the investigation, and authorities have not ruled out additional arrests as the international investigation continues.
The FBI says its teams are now working with international partners on further leads generated by the arrest. Its public message to the remaining ShinyHunters members makes clear that investigators expect the seized evidence and cooperation between agencies to produce additional information about the people behind the group’s operations.