U .S. federal investigators are pursuing the ShinyHunters gang, after identifying executives at two ransomware negotiation firms who allegedly maintained unusually close ties with the group. One US-based executive is accused of helping ShinyHunters run a website that pressured victims to pay, and investigators say messages from the gang indicate frequent contact with these negotiators.
ShinyHunters has claimed credit for numerous breaches since 2019, and the FBI says the group has extorted more than $70 million so far this year. In late September, ShinyHunters hacked the FBI’s recruitment site fbijobs[.]gov and threatened to publish stolen files, reportedly including sensitive personal data about agency personnel.
Dutch authorities also arrested Pepijn van der Stap, a ShinyHunters suspect linked to the extortion operation, and the arrest is connected to the broader investigation that has unfolded across multiple jurisdictions.
The probe also centres on a now-defunct extortion site called shinywire[.]com, which ran from 3 May 2026 until 16 October and listed nearly 100 attacked organisations, urging victims to engage with ShinyHunters and negotiating partners. The site embedded samples of stolen files and warned that data would be published if victims ignored demands.
Notable cases mentioned include PowerSchool, where a 2024 breach led to a $2.85 million ransom payment; Intuitive Surgical, breached in March 2026; and the DOJ’s recent prosecutions of ransom negotiators, such as MonsterCloud’s Zohar Pinhasi and Angelo Martino, who allegedly helped attackers maximise payments.
The article cautions that while paying is legally nuanced in the US, it is not prohibited to engage negotiators, and it notes concerns about conflicts of interest within the forensics and breach-response sector.