Dutch Arrest of 24-Year-Old Suspect Deals Blow to ShinyHunters, the Group That Claimed to Breach the FBI

Dutch authorities have arrested a 24-year-old man from Amsterdam on suspicion of belonging to ShinyHunters, an international cyber-crime collective that recently claimed responsibility for stealing sensitive data on roughly 38,000 FBI employees. The arrest, announced by Dutch police, marks a significant development in a fast-moving investigation that has drawn in law enforcement agencies on both sides of the Atlantic.

According to a police statement, the suspect was taken into custody on 15 September, several days before the alleged FBI intrusion. Investigators say they seized his devices and discovered a substantial quantity of information stored on his laptop, including details connected to two murders that were allegedly intended to be carried out abroad. Authorities suspect the man may have ordered those killings.

The suspect, who has remained in detention since his arrest, is additionally suspected of attempted incitement to commit two murders. Dutch officials have indicated that further arrests have not been ruled out as the inquiry continues.

Stan Duijf, who heads Dutch investigations into cyber-crime, said in a statement that ShinyHunters has been responsible for a large number of victims both domestically and internationally. He described the arrest as a positive step in the ongoing investigation into the group's activities.

The case gained international attention after ShinyHunters claimed it had breached FBI servers on 21 September. The group said it obtained the names, roles, badge numbers, home addresses and phone numbers of every bureau agent, covering approximately 38,000 people. It then began contacting journalists the following day, sharing samples and screenshots of what it said was stolen data. The BBC has reviewed a small portion of the material, which appears to be genuine.

According to the group, the breach exploited a vulnerability in the Oracle cloud storage system used by the FBI. ShinyHunters claims it gained access to multiple internal systems, including FBIJOBS, which handles recruitment; FBI BEAST, which conducts background checks on employees and applicants; FBI MedLink, which stores agents' medical records; and FBI BICS, which holds investigation-related information.

Rather than seeking financial gain, the group said it did not hack the FBI for money. Instead, it demanded that the agency retract a public service announcement issued in May that characterized ShinyHunters as "threat actors" who frequently use real or exaggerated claims of access to sensitive information to extract payment from victims. The advisory, which remains on the FBI's website, also stated that the group targets major companies across technology, finance and retail sectors, often stealing millions of customer records at once. ShinyHunters said it was offended by the description.

FBI Director Kash Patel responded to the Dutch arrest on X, thanking international partners and confirming that FBI teams were actively working to pursue additional leads generated by the apprehension. Brett Leatherman, assistant director of the FBI's Cyber Division, issued a direct message to members of the group, urging them to surrender while they still had the opportunity. He warned that other groups had believed anonymity or loyalty among associates would shield them, but that arrests often change who is willing to cooperate. He added that the longer individuals remain involved, the more investigators learn about them.

ShinyHunters is believed to have originated in France and has been linked to a series of high-profile breaches. In April, the group claimed responsibility for an attack on Rockstar Games. In May, it carried out a highly disruptive hack on the education platform Canvas. These incidents, combined with the alleged FBI breach, have established the collective as one of the more brazen and active cyber-crime operations currently under investigation by multiple national authorities.

The arrest in Amsterdam underscores the increasingly cross-border nature of cyber-crime investigations, where a single suspect in one country can be linked to breaches affecting governments and corporations worldwide. Dutch police have not disclosed further details about the suspect's alleged role within ShinyHunters or how long he had been under surveillance prior to his detention.

The FBI has not commented publicly on the specifics of the alleged breach beyond Patel's statement and Leatherman's remarks. It remains unclear whether the agency has been able to verify the full scope of the data ShinyHunters claims to possess, or whether the stolen information has been shared or sold to other parties.

For the tens of thousands of FBI employees whose personal details may have been compromised, the implications are serious. Exposure of home addresses and phone numbers poses potential security risks for agents and their families. The breach has also raised broader questions about the resilience of cloud infrastructure used by government agencies and the effectiveness of advisories intended to deter cyber-criminal groups.

The investigation remains active, with Dutch authorities indicating that more arrests could follow. As law enforcement agencies continue to trace the group's networks and infrastructure, the case serves as a reminder that even loosely organized international hacking collectives can face coordinated pressure from multiple countries at once.