THE FBI has urged members of the ShinyHunters hacking collective to come forward following the arrest of a suspected leader, Pepijn van der Stap, in the Netherlands on 15 September while on probation for earlier hacking and extortion offences. Dutch police described him as being involved with ShinyHunters and as having potentially planned two murders abroad, with investigators noting materials on his laptop that relate to those alleged plots.
The FBI characterises van der Stap as one of the group’s leaders and says he has been involved in targeting more than 140 organisations and collecting at least $70 million in extortion since 2025.
In response, the FBI warned remaining group members that arrests can prompt disclosures, and that investigators are monitoring seized infrastructure to identify those still at large. ShinyHunters has disputed the nature of its activities, stating that its recent publicity was a marketing campaign rather than extortion or ransom, and asserting that it did not intend to publish FBI data.
The group claims the FBI hack of the agency’s jobs site involved 5,000 FBI employees’ data samples and asserted it stole 2–3 terabytes of data, though it now portrays the incident as a communications strategy. Analysts quoted by SecurityWeek suggest the organisation functions as a brand with a decentralised, evolving membership, meaning arrests may disrupt but not necessarily end the group, which could rebrand or spin off. The piece notes ongoing negotiations and warning messages to victim organisations as the situation unfolds.