The FBI has announced that Dutch authorities arrested a 24-year-old man it describes as one of the alleged leaders of the ShinyHunters cybercriminal group, marking a major new development in the investigation surrounding the group’s recent activity.
The arrest was carried out by the Dutch National Police. The FBI said the suspect is linked to a group that has allegedly breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
What the FBI confirmed
FBI Cyber Division Assistant Director Brett Leatherman said Dutch authorities arrested one of the alleged leaders of ShinyHunters under Dutch law, with support from U.S. investigators. He said the action was intended to protect victims and preserve evidence.
The FBI also said the broader investigation remains active and directly warned other ShinyHunters members that investigators are continuing to identify people and infrastructure connected to the group.
Connection to the recent FBIJobs.gov incident
The arrest comes shortly after ShinyHunters claimed responsibility for unauthorized activity involving FBIJobs.gov and alleged that it obtained sensitive data related to FBI personnel and job applicants.
The FBI previously acknowledged that it was investigating unauthorized activity affecting FBIJobs.gov. Public reporting has documented the group’s claims, but the full scope and source of any stolen data remain important areas to distinguish from independently confirmed facts.
What Dutch authorities said
Dutch police said a 24-year-old man from Amsterdam was arrested in connection with the ShinyHunters investigation. The suspect had already been taken into custody before the group publicly claimed responsibility for the FBIJobs.gov incident.
Authorities are continuing to analyze seized digital evidence, and additional investigative action remains possible.
Why this matters to businesses
ShinyHunters has repeatedly been associated with large-scale data theft, cloud and third-party access abuse, social engineering, and extortion. The FBI has warned that actors using the ShinyHunters name may use stolen information, threatening messages, phone calls, and other pressure tactics against victims.
For businesses, the key lesson is that the risk does not end when one alleged member is arrested. Credentials, stolen data, infrastructure, and access obtained by a criminal group can continue to be used by other participants or sold to other threat actors.
What organizations should do
Organizations should continue to monitor for suspicious account activity, review privileged and third-party access, rotate exposed credentials, enforce multifactor authentication, and verify unexpected requests through known communication channels.
Companies that believe they have been targeted by ShinyHunters or related actors should preserve logs and evidence and report suspected intrusions to the FBI or the Internet Crime Complaint Center.
What remains unconfirmed
The FBI has described the arrested individual as an alleged leader. The criminal case and investigation are ongoing, and ShinyHunters has publicly disputed some claims about the suspect’s role. Those competing claims have not yet been resolved through a final court finding.
Sources
FBI: FBI Announces ShinyHunters Arrest
Reuters: Dutch arrest in ShinyHunters investigation