FBI Issues Direct Warning to ShinyHunters After Dutch Arrest
The Federal Bureau of Investigation has issued a public warning to members of the ShinyHunters extortion group, urging them to surrender following the arrest of an alleged leader by Dutch authorities. The statement comes after Dutch police detained a 24-year-old man from Amsterdam on September 15, whom the FBI described as one of the group’s key figures. FBI Cyber Division Assistant Director Brett Leatherman delivered the message in a video released Tuesday, emphasizing that law enforcement is actively targeting remaining members.
Arrest Reveals Evidence of Violent Criminal Activity
Dutch authorities announced that the suspect’s laptop contained significant evidence after his arrest, including details about two planned murders to be committed abroad. Police stated there are indications the suspect gave the order for these attacks. The Rotterdam District Court ruled on Tuesday that the suspect will remain in pre-trial detention for at least another 90 days, with investigators noting that further arrests in connection to the group remain possible.
ShinyHunters Linked to Over 140 Breaches and $70 Million in Extortion
The FBI alleges that ShinyHunters and its associates have compromised more than 140 organizations since the previous year, amassing at least $70 million through extortion schemes. The group is known for targeting corporate single sign-on (SSO) systems, third-party vendors, and cloud-based software-as-a-service platforms such as Salesforce and Snowflake. Their typical method involves stealing sensitive data before threatening to leak it unless a ransom is paid.
Group Claims Responsibility for FBI Data Breach
The warning follows ShinyHunters’ recent claim of responsibility for a major data breach against the FBI itself. The group told BleepingComputer that the intrusion exploited an Oracle PeopleSoft zero-day vulnerability, resulting in the theft of between two and three terabytes of data from FBI systems. This allegedly included information tied to multiple internal services. To substantiate their claim, ShinyHunters provided a sample of approximately 5,000 FBI personnel records to media outlets, including BleepingComputer.
While BleepingComputer declined to publish the sample, 404 Media reported that the exposed data included names and personal information of members of the FBI’s Remote Operations Unit — a classified team engaged in offensive hacking operations. Reuters further noted that some of the individuals identified were involved in investigations related to China and Russia, heightening concerns about the national security implications of the breach.
ShinyHunters Denies Financial Motive in FBI Attack
Despite the sensitivity of the stolen data, ShinyHunters told BleepingComputer that the FBI breach was not financially motivated, nor was it intended as an extortion attempt or a plan to publish the information. Instead, the group claimed the intrusion was carried out to challenge an FBI advisory that accused ShinyHunters of exaggerating their access to sensitive data, harassing victims and their families, conducting swatting attacks, and falsely claiming to possess compromising material.
FBI Signals Increased Pressure on Remaining Members
Assistant Director Leatherman used the video message to directly address remaining ShinyHunters members, stating that they have likely seen or heard developments not yet public. He warned that past assumptions about anonymity or protection from associates have proven false, noting that arrests often lead to increased cooperation and that seized digital infrastructure reveals who remains active.
Leatherman emphasized that investigators are continuing to build cases against those involved and are actively pursuing them. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours," he said. Dutch police also clarified that the arrested suspect was not detained in relation to the ShinyHunters-linked breach of Dutch telecom provider Odido, indicating the investigation spans multiple incidents.
Source: BleepingComputer