Dutch Arrest 24-Year-Old Suspected ShinyHunters Member After FBI Data Breach Claim

Dutch authorities have detained a 24-year-old man from Amsterdam on suspicion of belonging to ShinyHunters, the cyber-crime collective that recently claimed responsibility for stealing sensitive personal information belonging to roughly 38,000 FBI employees.

The arrest, announced by Dutch police, marks a significant development in an international investigation into a hacking group that has targeted a string of high-profile victims. According to officials, the suspect was taken into custody on 15 September, several days before ShinyHunters publicly claimed to have breached FBI systems on 21 September.

Police said they seized the man's devices and discovered what they described as a substantial trove of information on his laptop. Among the material were details connected to two murders that were allegedly planned to be carried out abroad, which investigators suspect he may have commissioned.

The suspect has remained in detention since his arrest. In addition to the allegations linking him to ShinyHunters, Dutch prosecutors are investigating him on suspicion of attempted incitement to commit two murders. Authorities have not excluded the possibility that more people will be arrested as the inquiry progresses.

Stan Duijf, who heads Dutch efforts to investigate cyber-crime, said the arrest represented a meaningful step forward. He noted that ShinyHunters has been responsible for a large number of victims both inside the Netherlands and internationally, and described it as positive that investigators had been able to detain a suspect linked to the group.

The FBI's director, Kash Patel, responded to news of the arrest by thanking Dutch partners. In a post on X, he said FBI teams were actively collaborating with counterparts to pursue and execute additional leads generated by the detention as the wider investigation continues.

Brett Leatherman, assistant director of the FBI's Cyber Division, used the moment to issue a direct message to other members of the group. He urged them to surrender while they still had the opportunity, warning that other criminal organisations had previously believed anonymity or loyalty among associates would shield them, only to find that arrests tend to change who is prepared to cooperate with authorities.

Leatherman added that the longer individuals remain involved with such groups, the more investigators learn about them, framing the arrest as part of a broader pressure campaign against the collective.

ShinyHunters alleges that it breached the FBI's servers on 21 September and began approaching journalists the following day, sharing samples and screenshots of what it said was stolen data. The BBC reported having seen a small portion of the material, which appeared to be authentic.

The group claims the compromised information includes the names, roles, badge numbers and personal details of FBI personnel, such as home addresses and telephone numbers. If verified, the scale of the exposure would represent an unusually severe security lapse for the bureau, affecting tens of thousands of employees.

According to ShinyHunters, the intrusion exploited a vulnerability in an Oracle cloud storage system used by the FBI. The group says this allowed it to reach multiple internal systems, including FBIJOBS, the bureau's recruitment platform, and FBI BEAST, which handles background checks for employees and applicants. It also claims to have accessed FBI MedLink, which stores agents' medical records, and FBI BICS, which holds investigation-related information.

The collective has stated that its motivation was not financial. Instead, it demanded that the FBI withdraw a public advisory issued in May that characterised the group. ShinyHunters said it took offence at the description contained in that notice.

The advisory, which remains published on the FBI's website, labels ShinyHunters as threat actors who frequently use real or inflated claims of access to sensitive data in order to extract payment from victims. It also notes that the group targets major companies across the technology, finance and retail sectors, often stealing millions of customer records in a single operation.

ShinyHunters is described as an international hacking collective that is believed to have originated in France. It has been linked to a series of prominent breaches, including an attack on Rockstar Games in April and a highly disruptive intrusion into the education platform Canvas in May.

The arrest in Amsterdam is likely to intensify scrutiny of how such groups operate across borders and how quickly law enforcement can respond to claims of major breaches. While the detention does not by itself confirm the FBI hack, it adds momentum to an investigation that spans multiple countries and involves some of the most sensitive systems in US law enforcement.

For the FBI, the episode has raised difficult questions about the security of cloud infrastructure used to store personnel and investigative records. The coming weeks are expected to bring further details about the scope of the alleged breach, the authenticity of the leaked material, and whether additional suspects will be identified.