FBI Says Alleged ShinyHunters Leader Arrested in Dutch Raid as Police Probe Murder Plots

The FBI and Dutch police announced Tuesday that they have arrested a man the FBI describes as one of the "alleged leaders" of ShinyHunters, the cyber-extortion gang that claimed responsibility for breaching the FBI's own systems earlier this month. In a twist that has stunned the cybersecurity world, Dutch investigators say a search of the suspect's laptop turned up information about two planned murders abroad — a second, separate criminal investigation that has nothing to do with the hacking probe.

The arrest marks the most significant law enforcement action yet against a group that U.S. and Dutch authorities blame for hacks at more than 140 organizations worldwide — including Ticketmaster, AT&T, Pornhub, and Dutch telecom provider Odido. It also lands just days after ShinyHunters said it stole terabytes of personal data belonging to "mostly all" FBI agents and job applicants from the bureau's careers website, a breach the FBI declared a "cyber security incident" earlier this week.

Photo: Dutch police officers in front of the Stopera in Amsterdam (file photo). Credit: Guido van Nispen, CC BY 2.0, via Wikimedia Commons.

What the FBI and Dutch police announced

Brett Leathermann, the head of the FBI's cyber division, said in a video message Tuesday that Dutch authorities had arrested one of the "alleged leaders of ShinyHunters." Leathermann said the Dutch High Tech Crime Unit "moved quickly to protect victims and preserve critical evidence," and vowed that the bureau would pursue the remaining members of the group. FBI Director Kash Patel separately announced the arrest on X, thanking Dutch police and private-sector partners for sharing information.

Dutch police, for their part, confirmed that an unnamed 24-year-old man from Amsterdam was arrested under Dutch law on September 15. The man was charged with "participating in a criminal organization," the charge covering the ShinyHunters investigation. He appeared before the Rotterdam District Court on Tuesday and was remanded in custody for at least 90 days. Investigators seized several data-storage devices and are still examining their contents, and authorities have warned that further arrests remain possible.

The murder-plot allegation

Then came the detail no one expected. After his arrest and the seizure of his devices, Dutch police said "a lot of information was found on his laptop, including about two murders that should be committed abroad." He is now also being investigated for attempting to orchestrate those murders, the police said — while stressing that this is "separate from the investigation into ShinyHunters."

Dutch media later reported, citing the national news agency ANP, that the suspect allegedly ordered the two killings and that the information was found on his laptop. It was not clear whether the murders actually took place, and Dutch police did not immediately confirm that characterization. The allegations are entirely unproven, and — in contrast to the hacking case — Dutch authorities have released almost no detail about them.

The man in custody: a "reformed hacker" hired to do security

Dutch police have not publicly named the suspect, in line with Dutch practice. But his identity was disclosed by his own employer: Benjamin Korper, the chief executive of Amsterdam-based cybersecurity company Neo Security, told Reuters the arrested man is Pepijn van der Stap, the company's offensive security lead. The news was first reported by independent security journalist Brian Krebs.

Van der Stap's backstory was already one of the most widely covered in European cybercrime. He was arrested in January 2023 and charged with hacking and blackmailing more than a dozen companies in the Netherlands and worldwide. He later pleaded guilty and was sentenced to four years in prison, with one year suspended, plus a three-year probationary period. Prosecutors estimated his extortion operations had brought in between €1.5 million and €2.7 million. He left prison in December 2025 and joined Neo Security, publicly presenting himself as a reformed hacker trying to make amends — a journey that drew international media coverage, including a Bloomberg profile.

Korper told Reuters he had carefully vetted van der Stap before hiring him, monitored him during his employment, and was shocked by the arrest. "Absolutely everybody I talked to is flabbergasted," he said, adding: "I truly believe that people deserve a second chance, but in this case I was not thanked for it." Dutch forensic investigators visited Neo Security's office on September 15, the night of the arrest, and the raid reportedly involved flash-bang grenades. Korper said he has hired an outside firm to investigate whether van der Stap hacked Neo Security or its customers; so far, investigators have found no evidence that he acted against his employer or its clients. Korper and van der Stap have not spoken since the arrest, and Reuters said attempts to reach van der Stap or identify a lawyer were not successful.

Photo: Canal houses on the Herengracht in Amsterdam (file photo). Credit: Anne Dirk, CC BY-SA 4.0, via Wikimedia Commons.

The "Umbreon" question — and why the attribution is disputed

Investigative journalist Brian Krebs and the site DataBreaches have identified van der Stap as the hacker who previously used the online alias "Umbreon," after the Pokémon character. Krebs reports that van der Stap used the alias in extortion activity on underground forums including BreachForums and the now-shuttered RaidForums as early as 2021, including in a listing for a database containing information on 2.3 million people in the Netherlands.

That detail would seem damning: when ShinyHunters defaced the FBI's jobs website around September 22, it embedded an oversized image of Umbreon in the defacement. But the connection is contested. BleepingComputer, summarizing Krebs's reporting, notes that the same Umbreon character appeared in a 2020 defacement of the HackForums website — a full year before van der Stap created his "Umbreon" account. And SecurityWeek, citing Krebs, reports that the FBI hack appears to have been pinned on van der Stap by ShinyHunters' current operator, a teenage cybercriminal from Amman, Jordan, known as Ray (also transliterated as Rey), who is also linked to the ScatteredLapsusHunters group.

In other words, the Pokémon clue pointing at van der Stap may itself have been planted — a frame-up by the people actually running the current operation. That theory would fit with a further twist: according to DataBreaches, the voice in the audio recording of the social-engineering attack on Dutch telecom Odido — a hack that exposed data on 6.2 million people and that ShinyHunters claimed — is not van der Stap's. Dutch police, notably, said the man in custody was not arrested in connection with the Odido hack.

What ShinyHunters says

ShinyHunters flatly denies any link to the arrested man. A representative for the group told TechCrunch that van der Stap "has no association with us." In a separate statement, the group called Dutch police incompetent and dropped an earlier deadline it had set for the FBI to rescind a public advisory about the group, softening its posture: "This was not a threat," the group said. "Nothing will happen."

The group also reiterated its claim that the FBI breach was not financially motivated, saying it was meant to challenge what it calls false public claims by the FBI about the group, and that it does not intend to publish the stolen FBI data. The FBI has not confirmed the full scope of the breach, though an internal memo reported by Reuters said the bureau was operating under the presumption that hackers stole data pertaining to all bureau employees — drawing comparisons to the disastrous 2015 hack of the U.S. Office of Personnel Management.

Why this matters

Take a step back and the picture is this: the FBI's characterization of van der Stap as an "alleged leader" of ShinyHunters is just that — a characterization. What Dutch police have actually charged is participation in a criminal organization, plus a separate and so-far opaque murder-plot investigation. The suspect's name came from his employer, not the authorities. No lawyer has been identified. And the people who claim to speak for ShinyHunters say he has nothing to do with them — while at least some of the evidence pointing at him, like the Umbreon imagery, may have been designed to point at him by others.

That uncertainty is the story now. If van der Stap was a leader of ShinyHunters, his arrest is a major blow to one of the world's most active data-theft operations — and the laptop trove could unlock the rest of the network. If he was framed, the real operators just demonstrated they can get Dutch police to raid their fall guy. And hanging over all of it is the murder allegation, which — if it holds — would make this one of the darkest hacker cases in European history. All of it, for now, is alleged. The Rotterdam court proceedings, and whatever the Dutch police release next, will determine which version is true.

Sources: reporting relied on TechCrunch (Zack Whittaker, Sept 29), Reuters (Raphael Satter, Anthony Deutsch, Andrew Goudsward, Sept 28–29), SecurityWeek, and BleepingComputer's summary of KrebsOnSecurity's investigation. Quotes attributed to their original outlets; disputed claims (the "Umbreon" handle attribution, the group's denial) are attributed to their sources.