Counterintelligence — 2026-10-03

FBI Issues Public Warning to ShinyHunters Members After Dutch Police Arrest Suspected Leader of Group That Breached Bureau Employee Data

BLUFArresting one alleged leader has not disrupted ShinyHunters' operational tempo, and the group will very likely claim at least one new victim organization within the next six weeks.

Dutch National Police announced on Tuesday that they arrested a 24-year-old Amsterdam man on September 15 on suspicion of ShinyHunters membership, and the FBI called him one of the group's alleged leaders 12. Police said a laptop search turned up details of two planned murders abroad, and the Rotterdam District Court ordered him held at least 90 more days 2. In a video, FBI Cyber Division Assistant Director Brett Leatherman said the group has breached more than 140 organizations and collected at least $70 million in extortion payments, and urged remaining members to "reach out first" 23. NBC News reported that the FBIJobs.gov breach occurred September 21, after the arrest, and that the FBI has not tied the two 4; ShinyHunters has since said it will not publish the data, calling the episode a "marketing campaign" 34.

Analysis
ShinyHunters will very likely claim at least one new victim organization between October 3 and November 15. The arrest of one alleged leader has not halted operations, since the group claimed the FBIJobs.gov breach while he was in custody and has reason to keep demonstrating reach after the FBI's appeal. Its pledge not to publish the data removes a leak risk but leaves the 2-3 terabytes and 5,000-record sample in circulation. Confidence is high, based on consistent reporting on the group's tempo, 140-plus prior victims, and the FBI's $70 million payment figure, though sourcing largely echoes official statements and none verifies the group's bureau claims. The FBI's video may instead fracture a loose collective and draw out informants, slowing public claims. Security teams running Salesforce, Snowflake, SSO and PeopleSoft should keep heightened monitoring through mid-November, and can scale back only if no claims appear.
4 sources
  1. Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters - FBI Cyber Division (X)
  2. FBI tells ShinyHunters members to turn themselves in after recent arrest - BleepingComputer
  3. FBI Warns ShinyHunters After Dutch Police Arrest Suspected Leader - Tickle The Wire
  4. FBI warns ShinyHunters crime group that hacked agent data after arrest - NBC News

View in full brief →

UNCLASSIFIED // OPEN SOURCE