FBI, Dutch Police Take Down Alleged ShinyHunters Cybercrime Group Leader
Dutch police and the FBI arrested an alleged ShinyHunters leader tied to 140 organizations and $70 million in extortion.
The FBI and Dutch National Police announced the September 15, 2026 arrest in Amsterdam of a 24-year-old man alleged to be a leader of ShinyHunters. The FBI says the group and associated operators have compromised more than 140 organizations since 2025 and collected at least $70 million by stealing data and threatening public disclosure. Dutch police seized devices including a laptop, and the Rotterdam District Court ordered at least 90 more days of pretrial detention. Investigators said the arrest is not tied to the separate Odido case; the group has also been linked to Pornhub, Ticketmaster, Oracle PeopleSoft, and activity against Cl0p leak infrastructure.
- A 24-year-old Amsterdam suspect was arrested on September 15, 2026.
- FBI cites over 140 victim organizations and at least $70 million extorted.
- Court ordered 90 more days of detention while seized devices are examined.
- Linked breaches include Pornhub and Ticketmaster; Odido arrest link denied.
Full article482 words · extracted from gbhackers.com · click to collapse
The FBI and Dutch National Police have announced the arrest of a 24-year-old man from Amsterdam who is suspected of playing a major role in the ShinyHunters cybercrime group.
This development marks a significant step forward in an international investigation into a widespread data theft and extortion operation.
The suspect was arrested on September 15, 2026, by Dutch authorities as part of an inquiry led by the country’s High Tech Crime Unit. FBI Director Kash Patel said Dutch authorities arrested the suspects under Dutch law, in coordination with FBI investigators, who are still pursuing additional leads on the group.
The FBI characterizes ShinyHunters as a global cybercrime organization linked to attacks on various entities in the United States, the Netherlands, and other countries.
According to the FBI’s Cyber Division, ShinyHunters and its associated operators have allegedly compromised over 140 organizations since 2025, amassing at least $70 million in extortion payments.
The group often targets third-party vendors and organizations that utilize cloud-based platforms. Attackers typically seek access to corporate environments, steal large volumes of sensitive information, and then pressure victims by threatening to publicly disclose the stolen data unless their extortion demands are met.
Dutch police said the arrested individual is suspected of belonging to a criminal organization linked to ShinyHunters. During the arrest, authorities seized several digital storage devices, including a laptop, which investigators are currently analyzing.
— FBI Director Kash Patel (@FBIDirectorKash) September 29, 2026This morning @FBI and our partners the Dutch National Police are announcing the arrest of one of the alleged leaders of ShinyHunters – a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world.
In coordination…
ShinyHunters has been linked to several high-profile data breaches, including incidents involving Odido, Pornhub, and Ticketmaster. However, Dutch investigators clarified that they did not arrest the suspect in connection with the separate investigation into the Odido breach.
The Rotterdam District Court has ordered that the suspect remain in pretrial detention for at least another 90 days while investigators continue to examine the seized evidence. Dutch authorities indicated that further arrests are possible.
This operation comes amid ongoing activity attributed to ShinyHunters. In recent weeks, the group has been connected to attacks on Oracle PeopleSoft environments as well as on the leak infrastructure of the Cl0p ransomware group.
The FBI said investigators are now using information from the arrest to identify additional infrastructure, associates, and potential victims.
Authorities emphasized that ongoing cooperation between law enforcement agencies and private-sector organizations is crucial to disrupting cybercrime operations that span multiple jurisdictions. The investigation into ShinyHunters is still ongoing.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.