Dutch Police Arrest Alleged ShinyHunters Leader as FBI Breach Fallout Grows

On Tuesday, September 29, 2026, the FBI and Dutch police announced the arrest of an alleged leader of ShinyHunters, the extortion group they link to data thefts at more than 140 organizations worldwide. Dutch police said the suspect is an unnamed 24-year-old man from Amsterdam, arrested on September 15 on suspicion of "participating in a criminal organization." At a hearing the same day, the Rotterdam District Court ordered him held in pre-trial custody for at least 90 more days.

Related reading: ShinyHunters Claims 284 Million Records From McKesson as Healthcare Breach Grows · Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records.

The announcement capped two weeks in which the hacking case and a separate, graver allegation became public at almost the same time. The man's seized laptop is also at the center of a Dutch investigation into whether he tried to arrange two murders abroad, a suspicion police say is unconnected to the ShinyHunters inquiry. And the arrest landed days after ShinyHunters claimed it had broken into the FBI's own job-application systems and stolen sensitive personnel data.

What Dutch police announced

The Dutch police statement says the man was arrested on Tuesday, September 15, by the National Investigation and Intervention Unit, with the High Tech Crime Team running the ShinyHunters inquiry under the national public prosecutor's office. He was held on suspicion of participating in a criminal organization, which the statement identifies as ShinyHunters.

After seizing his devices, police said they found a large amount of information on his laptop, "including about two murders that should be committed abroad," according to TechCrunch's translation of the statement. Police said there are indications he gave the order, and that he is therefore also under investigation for attempted incitement to commit two murders, a suspicion the statement says stands apart from the ShinyHunters investigation. Police said further arrests have not been ruled out.

Stan Duijf, the officer responsible for the police's cybercrime strategy, said in the statement that ShinyHunters has caused a large number of victims in the Netherlands and abroad and that the force was pleased to arrest a suspect in the investigation into the group. The statement also notes that the man was not arrested in the Odido investigation, the breach at the Dutch telecom that compromised data on more than 6.2 million people. That case remains open, and Dutch police have asked the public for help identifying a voice heard in a February 2026 call used to social-engineer an Odido employee.

The suspect, and a denial

Dutch police did not name the man. KrebsOnSecurity reported that three sources identified him as Pepijn van der Stap, and Reuters and Bloomberg subsequently named him. Reuters reported that Benjamin Korper, an executive at the Amsterdam cybersecurity firm Neo Security, confirmed the identity and described van der Stap as the company's offensive security lead. TechCrunch described the same role as chief technology officer, so the public accounts of his title differ.

Reuters also reported that Korper said Dutch forensic investigators visited his office on the night of September 15, when van der Stap was arrested in a raid that involved flash-bang grenades. Korper told Reuters he had vetted van der Stap before hiring him and monitored him during his employment.

"I truly believe that people deserve a second chance, but in this case I was not thanked for it," Korper said, adding that an outside firm he hired had so far found no evidence van der Stap acted against Neo Security or its clients. "Absolutely everybody I talked to is flabbergasted," he said.

Van der Stap had a prior conviction. Krebs reported that he was convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million, and was sentenced to four years in prison, one suspended. He was released in December 2025. He later presented himself as reformed, working as a software engineer at the security startup Hadrian and volunteering at the Dutch Institute for Vulnerability Disclosure before joining Neo Security, according to Krebs. Bloomberg profiled him in 2024 as a researcher who also extorted companies.

ShinyHunters, for its part, denies any connection. The group told TechCrunch that van der Stap "has no association with us," and told Reuters he had "no association" while calling Dutch police incompetent.

The FBI breach behind the arrest

The arrest followed a breach of the FBI's job-application portal. The bureau told employees that their personal information, including names, addresses, job titles and Social Security numbers, had been exposed in what it called a cyber security incident. ShinyHunters says it stole data on "mostly all" of the bureau's agents and applicants by breaking into apply.fbijobs.gov, the site for FBI jobs, and circulated samples to reporters along with an extortion demand.

The BBC reported that it had seen "fitness-for-work" medical exams containing blood and urine test results and doctors' notes, alongside agents' full names and addresses. Reuters reported that the stolen material also included psychiatric and medical evaluation records, and said it partially authenticated several files, including by running Social Security numbers against credit bureau data. The group claimed it held 2 to 3 terabytes, and the BBC noted it first claimed data on around 38,000 current employees before saying the figure could be around 60,000 current and former staff.

An internal FBI memo said the bureau was operating on the presumption that the hackers stole data on all employees, Reuters reported. In public statements the FBI has said it is "aggressively investigating" the incident and "working around the clock," and that it is examining whether the breach came through a third-party provider.

The hackers told TechCrunch that the breach was not financially motivated and that they would not publish the stolen FBI data, saying it was "to make a point and to dispute the allegations made against us and we have done so." Earlier, according to the BBC, they had threatened to publish the full dataset unless the FBI retracted a May advisory the group said offended it.

Counterintelligence stakes of the medical data

The medical records turn a data breach into a counterintelligence problem. Former FBI operative Eric O'Neill told Reuters that the presence of medical data pushed the hack toward the magnitude of the 2015 intrusion into the Office of Personnel Management and that the trove would attract hostile services.

"I would be shocked if Russian intelligence isn't knocking on their door and saying, 'We want that stuff, hand it over,'" O'Neill said.

Etay Maor, vice-president of threat intelligence at Cato Networks, told the BBC that the data cannot be reset the way a password can. "Passwords can be reset if stolen, but medical records cannot, so once this data is out, it stays compromised for good," he said. Ciaran Martin, the former head of the UK's National Cyber Security Centre, described the hack, if confirmed, as "as serious as it gets when it comes to data breaches," the BBC reported.

Names mapped to assignments, health histories and contact details can support blackmail, impersonation of law enforcement officers, and phishing tailored to specific agents. Reuters reported that some of the data concerns agents working on Russia, China and drug cartels, and 404 Media reported that details of a little-known FBI hacking unit were exposed. The combination of assignment data and medical records is what distinguishes this incident from a typical corporate leak.

How the group is said to operate

ShinyHunters has been active since 2019 and is accused of breaches at Pornhub, Ticketmaster and AT&T, as well as the Odido hack in the Netherlands. Leatherman said the group often targets third-party vendors in cloud-based platforms, stealing data and extorting victims with threats to publish it.

Krebs reported that the group gained access by exploiting CVE-2026-35273, a flaw in Oracle's PeopleSoft human-resources software, which it reportedly used as a zero-day from June. A Mandiant and Google Threat Intelligence Group report on September 25 confirmed mass exploitation of the flaw across sectors including higher education, technology, healthcare and government. BleepingComputer later reported that the group used a URL-encoding trick to sidestep web application firewall rules that Mandiant had recommended.

Estimates of the group's haul differ by source and scope. Leatherman said ShinyHunters had taken "at least $70 million in extortion payments" since last year, while Krebs reported a Mandiant researcher's estimate that the group is on track to collect nearly $100 million in 2026. The figures cover different periods and definitions of payment, and should be read as separate estimates rather than a single tally.

Krebs also reported that sources describe a change in the group's leadership, with a teenage operator using the name Rey said to have taken over the ShinyHunters brand as part of a merged group, and that an Umbreon-themed defacement left on the FBI jobs site may have been an attempt to implicate the Dutch suspect. Those accounts come from sources speaking to Krebs and have not been confirmed by authorities.

Caveats and what to watch

The central caveat is legal. The man is a suspect, not a convicted person in this case. Under Dutch law he is presumed innocent, and the murder allegation is a separate line of investigation that police have tied to evidence on his laptop but not to the hacking case. Police have not named him, and the identification comes from reporting by Krebs, Reuters and Bloomberg, not from an official statement. The title of his role at Neo Security is also reported differently by different outlets.

The scale of the FBI breach rests heavily on the hackers' claims and on documents that reporters have reviewed and partially authenticated. The FBI has not published a full accounting of who was affected or how many records were taken, and a group that has an interest in inflating its access is the source of several of the largest numbers.

Three things to watch. First, whether Dutch prosecutors file charges and whether the police make more arrests; the statement said new arrests are not excluded. Second, what happens to the FBI data. The group's public position has shifted from a publish threat to a promise to withhold it, and that could change. Third, whether the PeopleSoft flaw keeps producing breaches. A patched vulnerability, a known exploit and a published firewall bypass are the ingredients of a long campaign, and organizations running PeopleSoft have a narrow window to confirm they are patched.

For the FBI, the arrest removes one alleged operator. The bureau still does not know how much sensitive personnel data is now outside its control, or who might be willing to buy it.

Cover: The J. Edgar Hoover Building, the FBI's headquarters in Washington, D.C. Photograph by ajay_suresh via Wikimedia Commons, CC BY 2.0.