FBI, Dutch Police Take Down Alleged ShinyHunters Cybercrime Group Leader

The FBI and Dutch National Police have announced the arrest of a 24-year-old man from Amsterdam who is suspected of playing a major role in the ShinyHunters cybercrime group.

This development marks a significant step forward in an international investigation into a widespread data theft and extortion operation.

The suspect was arrested on September 15, 2026, by Dutch authorities as part of an inquiry led by the country’s High Tech Crime Unit. FBI Director Kash Patel said Dutch authorities arrested the suspects under Dutch law, in coordination with FBI investigators, who are still pursuing additional leads on the group.

The FBI characterizes ShinyHunters as a global cybercrime organization linked to attacks on various entities in the United States, the Netherlands, and other countries.

According to the FBI’s Cyber Division, ShinyHunters and its associated operators have allegedly compromised over 140 organizations since 2025, amassing at least $70 million in extortion payments.

The group often targets third-party vendors and organizations that utilize cloud-based platforms. Attackers typically seek access to corporate environments, steal large volumes of sensitive information, and then pressure victims by threatening to publicly disclose the stolen data unless their extortion demands are met.

Dutch police said the arrested individual is suspected of belonging to a criminal organization linked to ShinyHunters. During the arrest, authorities seized several digital storage devices, including a laptop, which investigators are currently analyzing.

ShinyHunters has been linked to several high-profile data breaches, including incidents involving Odido, Pornhub, and Ticketmaster. However, Dutch investigators clarified that they did not arrest the suspect in connection with the separate investigation into the Odido breach.

The Rotterdam District Court has ordered that the suspect remain in pretrial detention for at least another 90 days while investigators continue to examine the seized evidence. Dutch authorities indicated that further arrests are possible.

This operation comes amid ongoing activity attributed to ShinyHunters. In recent weeks, the group has been connected to attacks on Oracle PeopleSoft environments as well as on the leak infrastructure of the Cl0p ransomware group.

The FBI said investigators are now using information from the arrest to identify additional infrastructure, associates, and potential victims.

Authorities emphasized that ongoing cooperation between law enforcement agencies and private-sector organizations is crucial to disrupting cybercrime operations that span multiple jurisdictions. The investigation into ShinyHunters is still ongoing.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC