The FBI said Tuesday that Dutch police arrested an alleged leader of ShinyHunters, a cybercrime group the bureau says has breached more than 140 organizations since last year and collected at least $70 million in extortion payments. A Rotterdam court has ordered the suspect held.
FBI Director Kash Patel announced the arrest, and the FBI Cyber Division posted a video statement from Assistant Director Brett Leatherman. The suspect is a 24-year-old man from Amsterdam. He has not been tried, and every claim against him described below is an allegation.
What the FBI says ShinyHunters did
Leatherman said in the FBI’s video statement that the group and its co-conspirators allegedly breached more than 140 organizations and took at least $70 million. The bureau described a pattern of going after third-party vendors and cloud-based platforms, stealing sensitive data and then threatening to publish it unless victims paid.
That approach means one intrusion can reach many victims. A single compromised vendor or cloud account can open the data of every customer that vendor serves. Divided evenly, $70 million across 140 organizations comes to $500,000 each. The FBI has not said how many victims paid, so the payment per paying victim could be much higher.
CyberScoop reported that the group has run extortion attacks since 2025 and listed Instructure, Salesforce, Snowflake and McKesson among the 2026 victims. Cybersecurity News said the group has been linked to breaches at Ticketmaster, Pornhub and the Dutch telecom company Odido.
When the arrest happened and what the court ordered
Accounts vary on the date. The Associated Press story carried by WSOC reported that Dutch police arrested the man Sept. 15, and Fox News and Cybersecurity News gave the same date. Nextgov and Reuters, as carried by WCYB, gave the arrest date as Sept. 29, the day of the FBI announcement. AP and Cybersecurity News reported that a Rotterdam court ordered the man held for 90 days on Sept. 29.
Leatherman said in the video statement that the Dutch High Tech Crime Unit made the arrest under Dutch law, with full FBI support. He said the Dutch unit led because it had the legal authority and the operational capacity to act swiftly.
Police took data storage devices from the suspect and have not ruled out more arrests, the AP reported. Stan Duijf, a Dutch police cybercrime official, told the AP the group is responsible for “a large number of victims” in the Netherlands and abroad.
The AP also reported that police suspect the man of attempted incitement to commit two murders abroad. Police said that matter is separate from the hacking investigation.
Neither allegation has been tested in court. Officials have not named him, and this article does not either.
How the FBI and Dutch police divided the work
Leatherman described the case as an example of the FBI’s collaborative model, in which “the partner with the strongest authority and access leads.” The bureau supplied investigators and information while Dutch officers made the arrest. Fox News reported that Patel thanked Dutch authorities and industry partners, and that FBI teams are working with partners to pursue more leads from the arrest.
Dutch police describe the suspicion as participation in a criminal organization tied to ShinyHunters, according to Cybersecurity News. That report said investigators are examining the seized devices. The Rotterdam court’s order covers pretrial custody only and does not decide guilt.
The FBI’s message to the rest of the group
Leatherman used his video to address remaining members directly. “The longer you stay in this, the more we learn about you,” he said. Nextgov reported that he urged members to reach out to investigators first “while the choice is still yours,” and said arrests change who is willing to talk while seized infrastructure shows agents who is left.
The message came about a week after ShinyHunters made its own claim against the bureau. CBS News reported that the group said it stole 2 to 3 terabytes of data on nearly all FBI agents and job applicants, using a previously unknown flaw in Oracle PeopleSoft software. CBS said it had not independently established that the claim is accurate.
It reported that Reuters and 404 Media received sample data that corresponded to real FBI or Justice Department personnel, though neither outlet said the records came from FBI systems. CBS reported that the group claimed the stolen material came from criminal justice, human resources and Medlink systems.
The FBI said in a statement that it was “actively and aggressively investigating” the alleged impact to FBI employee personal information. CBS reported that the breach point remained undetermined.
ShinyHunters also denied any link to the man in custody. According to Reuters reporting carried by WCYB, the group said he had “no association” with its operation, dismissed the competence of Dutch police and withdrew a deadline it had set for the FBI. It had demanded that the bureau retract a May advisory about the group.
Why hospitals and health systems are watching
Health care has been among the group’s targets. John Riggi, the American Hospital Association’s national cybersecurity advisor, called ShinyHunters “one of the most prolific and aggressive” cybercriminal groups targeting the sector. The AHA cited an August alert from Health-ISAC, the health industry’s threat-sharing group.
That alert said attackers contacted employees directly on personal devices by call, voicemail and email, using fake medical-themed web domains to collect login credentials.
The AHA said the arrest fits the FBI’s updated cyber strategy of imposing costs on adversaries, supporting cybercrime victims and working with private-sector partners. If the 90 days run from Sept. 29, the detention period ends Dec. 28.
