Alleged ShinyHunters Leader Arrested After Group Claims FBI Data Breach

Dutch police have arrested a man they describe as an alleged leader of ShinyHunters, the cyber-extortion group that claimed this month to have stolen data on FBI agents and job applicants. The arrest of the 24-year-old Amsterdam man took place on September 15 and was announced on Tuesday, September 29, 2026, according to NBC News and BleepingComputer.

The FBI breach claim

On September 22, TechCrunch reported that ShinyHunters claimed to have breached the FBI and obtained what the group called "sensitive data on almost all FBI agents and individuals who filed an application with the FBI for a job."

According to TechCrunch, the hackers said they first got into an Oracle PeopleSoft server used for human resources and recruitment, then moved to a government cloud environment hosted by Amazon that held agent and applicant information. BleepingComputer reported that the group claimed to have used a zero-day flaw in PeopleSoft and to have taken 2 to 3 terabytes of data.

NBC News reported that the stolen data included Social Security numbers, dates of birth, phone numbers, addresses and emergency contact information. TechCrunch said 404 Media checked a sample of names, home addresses and phone numbers against public records. The incident centers on FBIJobs.gov, the bureau's job portal. The full scope of the group's claims has not been independently confirmed.

An FBI spokesperson told TechCrunch: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." ShinyHunters said the hack was not financially motivated and demanded that the FBI take down a report about the group, according to TechCrunch.

The arrest

BleepingComputer reported that a Rotterdam court ordered the suspect held in pre-trial detention for at least 90 days. Dutch authorities also said material found on his laptop related to planned murders abroad and that there are indications he ordered them, according to BleepingComputer and NBC News. These allegations have not been proven in court.

The arrest came before ShinyHunters publicly claimed the FBI breach.

The FBI's message to the group

FBI Cyber Division Assistant Director Brett Leatherman released a video addressed to the group's remaining members. "You've heard about the arrest of your colleague," he said, according to NBC News and BleepingComputer. He added: "I suggest you reach out first while the choice is still yours."

According to BleepingComputer, the FBI says ShinyHunters has breached more than 140 organizations since last year and collected at least $70 million in extortion payments. The group has targeted corporate single sign-on accounts, third-party vendors and cloud software platforms including Salesforce and Snowflake.

Why it matters

A breach of FBI personnel and applicant records would expose some of the most sensitive data the US government holds. TechCrunch noted that such data could pose a counterintelligence threat if used to pressure agents or their families. The arrest of an alleged leader is one of the most significant law enforcement actions against a group linked to a long run of large data thefts.

Sources

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.