ShinyHunters is pushing back against the FBI’s portrayal of a recent arrest in the Netherlands, insisting that the detained cybersecurity professional is not part of its current operation and that the group remains unaffected by the investigation.
Dutch authorities arrested a 24-year-old Amsterdam man on September 15 as part of an investigation into ShinyHunters. The suspect has been identified by his former employer and media reports as Pepijn van der Stap, a cybersecurity professional who previously served prison time for hacking and extortion offenses.
The FBI has presented the arrest as an important breakthrough. Cyber Division Assistant Director Brett Leatherman described the suspect as one of the alleged leaders of ShinyHunters and said the individual and his co-conspirators have been linked to attacks against more than 140 organizations since last year. The bureau estimates that the operation collected at least $70 million in extortion payments.
ShinyHunters disputes that characterization. In statements issued following the announcement, the group denied that Van der Stap is associated with its current operation and rejected suggestions that his detention represents a major disruption.
The dispute is complicated by Van der Stap’s previous involvement in cybercrime. He was arrested in 2023 and later convicted of hacking, data theft, and extortion offenses linked to earlier ShinyHunters activity. After leaving prison, he publicly presented himself as reformed and worked in offensive cybersecurity.
ShinyHunters’ name has also changed hands and become associated with overlapping cybercrime communities over the years. This makes identifying who currently controls the operation more complicated than treating it as a conventional organization with a fixed membership structure.
Dutch investigators have not publicly detailed the evidence connecting Van der Stap to the group’s more recent attacks. Authorities have seized storage devices and are examining their contents, while a Rotterdam court has ordered him to remain in pretrial detention for another 90 days.
The arrest predates ShinyHunters’ recent confrontation with the FBI. Van der Stap was already in custody when the group publicly claimed on September 22 that it had compromised FBIJobs.gov and stolen sensitive personnel information.
ShinyHunters has claimed that the FBI intrusion resulted in the theft of several terabytes of information covering agents, employees, and job applicants. The FBI has acknowledged a cybersecurity incident involving FBIJobs.gov and the exposure of some employee personal information, but the full scale of the hackers’ claims has not been independently confirmed.
The group subsequently said it never intended to publish or sell the FBI information. It characterized the operation as a publicity campaign intended to challenge an FBI advisory that ShinyHunters claims inaccurately described its methods.
The FBI, meanwhile, has taken a very different approach following the Dutch arrest. Leatherman publicly encouraged other ShinyHunters participants to contact authorities, while FBI Director Kash Patel said investigators are pursuing additional leads generated by the case.
For now, the two sides are presenting sharply different versions of what the arrest means. The FBI considers the detained man an alleged leader whose arrest could help expose additional participants, while ShinyHunters maintains that he has no connection to its current operation and insists its activities remain intact.