Dutch police have arrested a 24-year-old Amsterdam man on suspicion of belonging to ShinyHunters, the cybercrime group that claimed last week to have stolen personal data on around 38,000 FBI staff. Police also suspect him of attempted incitement to commit two murders abroad. Dutch media, citing sources, identified him as Pepijn van der S.; Dutch police do not release full surnames of suspects.
He was arrested on 15 September, before the group's alleged FBI breach, but the arrest only became public this week. Police said they found a large amount of information on his laptop, including details of two murders to be carried out abroad, and there are indications he ordered them. Officers also seized other data carriers. The Dutch daily AD reported that heavily armed officers from the police's special interventions unit raided his home in Amsterdam's Rivierenbuurt district, reportedly using stun grenades. He is being held in full isolation, with contact allowed only with his lawyer, and a judge extended his pre-trial detention by 90 days. Police say the murder allegations are unrelated to the ShinyHunters investigation, and they have not said who the targets were. Further arrests have not been ruled out.
The FBI has described the suspect as possibly one of the group's leaders, but Dutch police say his exact role is still under investigation. They stress he was not arrested over the February attack on Dutch telecoms provider Odido, in which data of millions of Dutch people was stolen. FBI Cyber assistant director Brett Leatherman said the group has allegedly hacked more than 140 organisations since last year and collected at least $70 million in ransom. He urged other members to surrender "while the choice is still yours", and FBI director Kash Patel thanked Dutch partners and said teams were pursuing more leads.
ShinyHunters, believed to have originated in France, has also been linked to breaches at Rockstar Games and the education platform Canvas. It claims to have entered FBI systems, including ones for job applications, background checks and medical records, through a flaw in Oracle cloud storage. The BBC has seen a small portion of the data, which appears genuine. In a dark web message, the group said it acted not for money but because it was "offended" by an FBI advisory that characterised it as extorting victims, and it demanded the advisory be withdrawn.
The suspect's background has drawn attention in the Netherlands. In 2023 he was sentenced to four years in prison for extortion, data theft from companies and laundering large amounts of cryptocurrency. His lawyer has said he had a difficult childhood and psychological problems. He was released early this year and worked for the security firm Neo Security, whose owner said he was astonished by the allegations. An external review found no signs that company or client data was compromised. Prosecutors have yet to set out their case.