In a video message released Tuesday, FBI Cyber Division Assistant Director Brett Leatherman addressed the hackers directly. "You know how to find us, and we know how to find you," he said.
"I suggest you reach out first while the choice is still yours." He added that "arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left."
Arrest in the Netherlands
Dutch National Police said the suspect was arrested on September 15 under Dutch law for participating in a criminal organization, and credited the Dutch High Tech Crime Unit with moving quickly to protect victims and preserve evidence.
On Tuesday, the Rotterdam District Court ruled that the man will remain in pre-trial detention for at least another 90 days. Neither Dutch authorities nor the FBI has publicly named him.
Krebs on Security and Reuters identified the suspect as Pepijn van der Stap, a Dutch man previously convicted of data theft and extortion in 2023 who joined the Dutch cybersecurity firm Neo Security after his release from prison last year. ShinyHunters disputes the identification: the group told Reuters that van der Stap has "no association" with it.
In a startling disclosure, Dutch police said a search of the suspect's seized laptop uncovered details of two murders planned abroad, and that there are indications he ordered them. He is now also under investigation for attempted incitement to commit two murders — a case Dutch authorities say is separate from the ShinyHunters investigation.
More than 140 organizations breached
In his video, Leatherman said ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
The group typically compromises corporate single sign-on accounts and targets third-party vendors and cloud platforms such as Salesforce and Snowflake, stealing data before threatening to publish it.
Dutch authorities say the gang is accused of breaches at Pornhub, Ticketmaster, and U.S. telecom giant AT&T, and it also claimed a hack of Dutch phone provider Odido — though police noted the arrested man was not detained in connection with the Odido incident.
FBI Director Kash Patel said FBI teams are "actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest."
Warning follows the FBIJobs.gov saga
The warning lands just days after ShinyHunters claimed responsibility for breaching the FBI's own recruitment portal, FBIJobs.gov, claiming it stole two to three terabytes of personnel data.
On Monday, the group told reporters it had decided from the outset never to publish the data, calling the standoff a "marketing campaign" meant to dispute a May FBI advisory.
The bureau has not explicitly linked the Dutch arrest to the FBIJobs.gov incident — the group claims that breach happened after the man was detained — and Leatherman's video did not address the FBI hack directly. But his closing message to the group's remaining members was unmistakable: "The longer you stay in this, the more we learn about you."
By Hamza Faisal
