Dutch police arrested a 24-year-old Amsterdam man on September 15 for his alleged role leading the hacking group ShinyHunters, which claimed to have stolen between two and three terabytes of FBI data. The FBI announced the arrest jointly with the Dutch National Police on Tuesday.
The stolen material reportedly includes names, home addresses, phone numbers, dates of birth, and personal details about FBI employees’ spouses. According to reporting on the breach, the haul also includes private medical records of FBI agents and information tied to some of the bureau’s most sensitive work, including personnel and assignments connected to Chinese spies, Russian intelligence, and drug cartels.
Dutch authorities said the suspect is also under investigation for attempting to incite two murders, though it remains unclear who the intended targets were or why. Police say further arrests are possible as they comb through seized electronic devices.
The FBI called ShinyHunters “a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world.” The bureau said the Dutch High-Tech Crime Unit made the arrest under Dutch law in coordination with FBI investigators, and that FBI teams are “actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest.”
A Warning to the Rest of the Group
Brett Leatherman, assistant director of the FBI’s Cyber Division, delivered a pointed message to any remaining ShinyHunters members in a video statement.
“To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague. We’re confident you’ve seen or heard things in recent days that the public has not. Other groups believed anonymity or their friends would protect them, and they were wrong. Arrests have a way of changing who is willing to talk. And seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us and we know how find you. I suggest you reach out first while the choice is still yours.”
Breach Larger Than First Thought
The FBI employs roughly 38,000 people, but ShinyHunters now claims it holds sensitive information on approximately 60,000 current and former FBI personnel — a larger figure than initially reported. The FBI has not independently confirmed that number.
Dutch security firm Neo has identified the arrested man as Pepijn van der Stap, its own offensive security lead, who reportedly goes by the online handle “Umbreon.” Authorities have not officially confirmed his identity. Van der Stap is a previously convicted hacker who had publicly described himself as reformed after leaving prison in 2025. He is also being investigated for a possible connection to the breach of Dutch telecom provider Odido.
