Alleged ShinyHunters Leader Arrested in Amsterdam
Authorities in the Netherlands arrested a 24-year-old man in Amsterdam suspected of being a key figure in the cybercrime group ShinyHunters. The Dutch National Police confirmed the arrest but did not publicly name the individual. However, independent cybersecurity journalist Brian Krebs identified the suspect as Pepjin van der Stap, a previously convicted cybercriminal who had worked intermittently as a cybersecurity professional.
Connection to FBI Breach and Extortion Campaign
The arrest occurred approximately one week before ShinyHunters claimed responsibility for infiltrating FBI systems and exfiltrating sensitive data on nearly every FBI agent. This timing underscores the significance of the detention in the broader investigation into the group’s activities. Law enforcement officials allege that ShinyHunters has been active since at least 2025, conducting a series of high-profile data breaches and extortion attacks.
Scale of ShinyHunters’ Criminal Operations
According to Brett Leatherman, assistant director of the FBI’s Cyber Division, ShinyHunters and its associates have allegedly compromised more than 140 organizations worldwide and extorted at least $70 million in payments. Leatherman made these remarks in a statement posted on YouTube, where he detailed the group’s typical tactics: targeting third-party vendors connected to cloud-based platforms, stealing sensitive data, and threatening to leak it unless ransom demands are met.
Evidence Recovered and Ongoing Detention
During the arrest, Dutch authorities seized van der Stap’s laptop and reportedly recovered a substantial amount of evidence, including information allegedly linking him to two murders committed abroad. A court in Rotterdam has since ordered him to remain in detention pending trial for a minimum of 90 days, citing the seriousness of the charges and the risk of flight or obstruction.
Previous Victims and Ongoing Threat
ShinyHunters has been linked to breaches affecting a wide range of sectors, including cloud infrastructure providers, healthcare organizations, educational institutions, technology firms, retailers, and universities. In 2025 alone, the group has been associated with attacks on companies such as Instructure, Salesforce, Snowflake, and McKesson, demonstrating its broad reach and persistent threat to critical supply chains.
Law Enforcement Message to Cybercriminals
In his public statement, Leatherman directly addressed other members of ShinyHunters, warning that the arrest of van der Stap should serve as a deterrent. He emphasized that law enforcement is actively pursuing additional leads and that seized infrastructure often reveals further connections within criminal networks.
“You’ve heard about the arrest of your colleague. We’re confident you’ve seen or heard things in recent days that the public has not. Other groups believed anonymity or their friends would protect them, and they were wrong,” Leatherman said. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you.”
He concluded with a direct appeal: “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”
Continued Collaboration Across Agencies
FBI Director Kash Patel reinforced the ongoing nature of the investigation in a post on X (formerly Twitter), stating that FBI teams are collaborating with international partners to follow up on leads generated by the arrest. This coordinated effort reflects a growing strategy among global law enforcement agencies to dismantle transnational cybercrime syndicates through intelligence sharing and joint operations.
Source: CyberScoop