Law enforcement is escalating pressure on the ShinyHunters extortion operation after Dutch authorities apprehended a suspected member of the group's leadership. In a video statement released Tuesday, FBI Cyber Division Assistant Director Brett Leatherman announced the development and directly addressed remaining members of the organization.
Dutch National Police took into custody a 24-year-old resident of Amsterdam on September 15. Investigators suspect the man held a significant position within ShinyHunters and was involved in criminal organization activities. Police disclosed that examination of his laptop yielded substantial evidence, including information regarding planned murders to be carried out internationally. "There are indications that the suspect gave the order for this," authorities stated.
The Rotterdam District Court determined Tuesday that the detainee will remain held pending trial for a minimum of 90 additional days. Authorities have not excluded the possibility of further arrests in connection with the investigation.
Scale of the Operation
According to federal law enforcement, ShinyHunters and its associates have successfully compromised more than 140 organizations over the past year and extracted approximately $70 million through extortion schemes. The group typically focuses on corporate single sign-on systems, external service providers, and cloud-based platforms including Salesforce and Snowflake, using stolen data as leverage to demand payment.
The FBI Breach
The enforcement action follows ShinyHunters' recent assertion that it had breached FBI infrastructure. The group told BleepingComputer that the intrusion exploited an unpatched Oracle PeopleSoft vulnerability. ShinyHunters claimed to have obtained between two and three terabytes of material from FBI systems spanning multiple internal services.
The group subsequently distributed approximately 5,000 FBI personnel records to news outlets to validate its claims. While BleepingComputer declined to accept the data, 404 Media reported that the compromised records included names and personal information of members belonging to the FBI's Remote Operations Unit, a classified unit conducting offensive cyber operations. Reuters noted that some exposed personnel worked on investigations focused on China and Russia, underscoring the sensitive nature of the material.
Notably, ShinyHunters stated to BleepingComputer that the FBI operation was not motivated by financial gain, extortion, or plans to release the data publicly. Instead, the group characterized the breach as a response to an FBI advisory claiming that ShinyHunters members frequently overstate their access to confidential information, intimidate targets and their families, execute swatting operations, and make false claims about possessing damaging material.
Direct Appeal to Remaining Members
Leatherman used the video announcement to make a direct appeal to active ShinyHunters participants. "You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not," he stated.
The official drew parallels to past cases, noting that "Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left."
https://www.youtube.com/embed/bxLNRd7WvzU
Leatherman emphasized that investigators continue building their understanding of group participants and that individuals remain under active investigation. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours," he concluded.
Dutch police clarified that the arrested individual was not apprehended as part of the separate investigation into ShinyHunters' breach of Odido, a Dutch telecommunications company.