ShinyHunters Arrest: FBI Warns Remaining Members as FBIJobs Breach Claims Remain Unverified

Security teams running Salesforce, Snowflake, single sign-on and other SaaS platforms should pay attention. This is the group that has made a business of stealing data from exactly those systems.

The arrest: what Dutch police have actually said​

According to BleepingComputer, Dutch police said the suspect is a 24-year-old man from Amsterdam. He was arrested on September 15 on suspicion of playing a role within ShinyHunters and participating in a criminal organization. The arrest was only made public on Tuesday, September 29, two weeks after it happened.

Several outlets confirm the key points:

• Detention: TechCrunch reported that the man appeared in court Tuesday and has been remanded into custody for at least 90 days. BleepingComputer says the ruling came from the Rotterdam District Court. This is pre-trial detention, not a finding of guilt.
• More arrests possible: The Dutch authorities said they had seized several data carriers and further arrests in the case could not be ruled out.
• A separate murder allegation: Police said that after the arrest they found a large amount of information on his laptop, including details of two murders meant to be carried out abroad. They also said there are indications he gave the order. The Associated Press, via ABC News, reported that police said this suspicion "is not related to the investigation into ShinyHunters."
• Not the Odido case: Dutch police also told BleepingComputer that the man was not arrested as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido.

Police have not named the suspect. The Hacker News reported that independent security journalist Brian Krebs and DataBreaches.Net identified the arrested man as Pepijn van der Stap (aka Umbreon), who was previously apprehended in 2023 for his role in a series of data thefts and extortions. ShinyHunters disputes the link. A representative for the group told TechCrunch that Van der Stap "has no association with us." A crime group denying its own members is nothing new, but the identification has not come from the authorities either. Treat it as reported, not confirmed.

Section summary: One suspect is in custody for at least 90 days on suspicion of taking part in ShinyHunters. Police say a separate allegation that he tried to arrange two murders is not part of the hacking investigation, and the arrest has nothing to do with the Odido probe.

The FBI's message to the remaining members​

The FBI took an unusually direct approach. In a video released Tuesday, FBI Cyber Division Assistant Director Brett Leatherman spoke straight to the remaining members. He opened with "To the remaining members of ShinyHunters: You've heard about the arrest of your colleague," and went on to say that "Arrests have a way of changing who is willing to talk. And seized infrastructure has a way of showing us who's left."

He ended by telling them the longer they stay involved, the more the FBI learns about them, and urged them to reach out while the choice is still theirs. TechCrunch reported that Leatherman also said the Dutch High Tech Crime Unit "moved quickly to protect victims and preserve critical evidence," and promised the bureau would go after the rest of the group.

FBI Director Kash Patel posted his own statement. According to the AP, he said "In coordination with FBI investigators the Dutch High-Tech Crime Unit arrested the suspect under Dutch law," he added. "As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest."

The two countries are telling the story differently, though. The AP noted that the Dutch police statement announcing the arrest did not mention the FBI hack or coordination with American law enforcement. Washington is presenting this as a joint win. Dutch police are presenting it as a domestic arrest under Dutch law.

Does the video mean the FBI knows who everyone is? Not necessarily. Public appeals like this are partly psychological pressure: they aim to sow distrust inside a group and get people talking. It's a warning, not proof that every member has been identified.

Section summary: The FBI is using the arrest to press remaining members publicly. Patel describes US–Dutch coordination, but the Dutch police statement did not mention it.

The FBI's numbers on ShinyHunters​

The bureau says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments. These are the FBI's figures, as quoted by BleepingComputer, and no one has audited them independently.

BleepingComputer describes the group's methods: going after corporate SSO accounts, third-party vendors and cloud SaaS platforms such as Salesforce and Snowflake, stealing data, then threatening to publish it unless paid.

The FBI's Internet Crime Complaint Center (IC3) described the pressure tactics in a May 15, 2026 public service announcement. That notice was written after ShinyHunters claimed an attack that disrupted an online learning management system used by schools. It called ShinyHunters a group specializing in large-scale data breaches and extortion against major tech, finance and retail companies, and warned that:

• The group uses real or exaggerated claims of access to sensitive data to push victims into paying.
• Victims and their family members may get threatening texts and phone calls, and in some cases have been swatted.
• The group may falsely claim to hold embarrassing photos or videos, which the FBI says frequently do not exist.
• Stolen data has sometimes ended up on the group's leak sites on the Tor network. It can also fuel convincing spear-phishing or be sold to other criminals.

The FBI jobs-site breach claim: still unconfirmed​

The FBI's public push comes days after ShinyHunters said it had breached the bureau itself. According to CBS News, the group claimed it stole two to three terabytes of data related to FBI and Justice Department workers. The hackers said they used a new vulnerability in Oracle PeopleSoft, a human resources management program.

The timing is worth noting. CBS News pointed out that the suspect was already in custody days before ShinyHunters announced it had hacked the FBI jobs website, which was first reported on Sept. 22 by 404 Media.

Here's what has been reported so far, and by whom:

The FBI told CBS News it is "working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted". TechCrunch reported that the FBI has not yet publicly confirmed a breach, but the ShinyHunters gang said it took personal and sensitive data belonging to "mostly all" of the FBI's agents and applicants.

ShinyHunters says the attack was about something other than money. The group told BleepingComputer it was never an extortion attempt and that it had no plans to publish the data. Instead, it says it wanted to push back on the FBI advisory describing its harassment and exaggeration tactics. In a statement to The Hacker News, the group said "this is not extortion, it was never one to begin with, not a threat, not a ransom, and not financially motivated."

Should anyone take that at face value? A group the FBI accuses of exaggerating is objecting to being called exaggerators, while claiming to hold an enormous amount of the bureau's personnel data. Readers can judge that for themselves.

Section summary: The FBI jobs-site breach is a separate story from the arrest. The volume of data and the zero-day are ShinyHunters' claims, and the FBI has acknowledged an incident without describing its scope.

What this means for Windows and enterprise IT teams​

One arrest does not end the threat, and the FBI's warning suggests the investigation expects more activity. ShinyHunters mainly goes after identity and SaaS systems rather than endpoints. For most organizations, that means the pressure falls on sign-in controls, third-party app permissions and help-desk procedures.

Based on the FBI's IC3 guidance, here is what to do if your organization or an employee gets contacted by someone claiming to be ShinyHunters:

• Don't pay and don't engage. The FBI's advice is to not send payment or respond to demands.
• Check claims through a separate channel. Confirm urgent or unusual requests another way, and treat unexpected calls or messages claiming to be from vendors, IT support or law enforcement with caution.
• Keep everything. The FBI asks victims to save usernames, email addresses, monikers, websites, communication platforms, photos and videos.
• Report it. Suspected ShinyHunters intrusions can go to IC3, a local FBI field office, or 1-800-CALL-FBI (225-5324). Reports should include the date, time, location, type of activity, number of people and equipment involved, the organization's name and a named contact.
• Take back control of accounts. Contact account providers, change passwords and set up alerts for suspicious logins or transactions.
• For an immediate, life-threatening emergency, call 911. This matters given the group's history of swatting.

Beyond the advisory (general industry practice, not FBI guidance): Since SSO accounts and SaaS integrations are the group's main targets, it makes sense to review which third-party apps have access to your CRM and data-warehouse tenants. Use phishing-resistant MFA for administrator accounts wherever possible, and tighten help-desk checks for password and MFA resets. Staff should also know that a threatening message about their family is a pressure tactic the FBI has documented. It doesn't prove the sender has any real access.

The bottom line​

A 24-year-old Amsterdam man is being held for at least 90 days on suspicion of involvement in ShinyHunters. A separate allegation that he tried to arrange two murders is, according to police, not part of the hacking case. The FBI is using the arrest to warn the rest of the group publicly. Meanwhile, the group's claimed breach of the FBI jobs portal remains under investigation, with the scope unconfirmed.

Whether the video convinces anyone to come forward will depend on what those seized storage devices contain. Until then, defenders should keep treating ShinyHunters as an active threat.

Update: Additional details (September 30, 2026)​

A LinkedIn report citing Reuters says investigators examined a roughly 5,000-row sample ShinyHunters offered as evidence of the FBIJobs.gov compromise and verified details relating to more than 22 people. Reuters reportedly could not authenticate the complete spreadsheet, confirm that all job assignments remained current, or substantiate the group’s claim that it stole two to three terabytes.

The report also says an internal FBI memo instructed personnel to act on the assumption that every employee could have been exposed. That is a precautionary operating assumption rather than a confirmed forensic total, but it underscores the potential risks for staff in sensitive roles and their families.

Separately, the report points to Google Mandiant’s September 25 research on exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273, which Mandiant attributes to UNC6240/ShinyHunters. Mandiant said attackers had adjusted techniques to bypass some web-application firewall rules and recommended patching, investigating for compromise, rotating accessible credentials, revoking active sessions and OAuth authorizations, and restricting new device enrollment during containment. The research does not establish that this was the route used against FBIJobs.gov.