Dutch police arrest alleged ShinyHunters leader, probe murder plot

The FBI and Dutch law enforcement say they have arrested a member of the ShinyHunters hacking group, which the agencies say is responsible for hacks on more than 140 organizations worldwide. The hackers also claimed responsibility for a breach of the FBI’s own systems earlier this month. Brett Leathermann, the FBI’s cyber division lead, said in a video message on Tuesday that Dutch authorities had arrested one of the “alleged leaders of ShinyHunters,” adding that the Dutch High Tech Crime Unit “moved quickly to protect victims and preserve critical evidence” and vowing that the bureau would pursue the rest of the group.

Dutch police confirmed that an unnamed 24-year-old man from Amsterdam was arrested under Dutch law on September 15, for “participating in a criminal organization.” He was scheduled to appear in court on Tuesday and has been remanded into custody for at least 90 days. Following the arrest and seizure of his devices, police said “a lot of information was found on his laptop, including about two murders that should be committed abroad,” and that he is separately being investigated for attempting to orchestrate the killings — an investigation Dutch authorities said is “separate from the investigation into ShinyHunters.” The group is accused of hacking into companies to steal data and then threatening to publish it unless victims pay a ransom, including breaches at Pornhub, Ticketmaster and AT&T; the gang also claimed the breach of Dutch phone provider Odido, though authorities say the arrested man has not been arrested in relation to that hack.

Independent security journalist Brian Krebs, who first reported the arrest, and other outlets have named the arrested man as Pepijn van der Stap, profiled by Bloomberg in 2024 as a cybersecurity researcher who also moonlighted as a criminal hacker extorting companies. According to Bloomberg and Reuters, Van der Stap was arrested earlier this month at the offices of Neo Security, where he is employed as chief technology officer. Asked by TechCrunch, a ShinyHunters representative said Van der Stap “has no association with us.”

The arrest comes days after the FBI reportedly told its own agents and employees that their personal information — names, addresses, job titles and Social Security numbers — was exposed in a “cyber security incident.” The FBI has not publicly confirmed a breach, but ShinyHunters said it took data belonging to “mostly all” of the FBI’s agents and applicants by breaching its careers website and job application portal. Among a sample of roughly 5,000 affected agents, reporters have also found data relating to blood and urine samples and psychiatric reports, sparking fears of a major counterintelligence challenge. ShinyHunters told TechCrunch the FBI breach was not financially motivated but intended “to make a point and to dispute the allegations made against us,” and that the group will not publish the stolen data.

Why it matters

The arrest marks a rare law-enforcement win against one of the most prolific extortion gangs of the past two years, though Dutch authorities have taken pains to note that the murder-plot investigation is separate from the ShinyHunters case — a distinction that will matter for how the eventual prosecution unfolds.