Dutch police hold ShinyHunters suspect as FBI seeks hackers

• Dutch police say they arrested the man on 15 September on suspicion of playing a role in ShinyHunters and seized electronic devices.¹
• On 29 September, a Rotterdam court ordered him held for another 90 days.¹
• Reuters reported that the suspect’s employer identified him as Pepijn van der Stap; police have not publicly named him.²
• The arrest preceded ShinyHunters’ public claim about the FBI jobs portal by a week.³
• FBI cyber chief Brett Leatherman urged the group to contact the bureau, saying investigators knew how to find its members.⁴

Dutch police said the investigation concerns suspected involvement in ShinyHunters, a data-theft and extortion group. They have not said the suspect was arrested over the FBI portal incident. The bureau’s own statement says it is investigating the claim and has not determined whether the breach began with a third-party provider or inside FBI systems.¹⁵

Reuters identified the man as Van der Stap after speaking to his employer, Neo Security chief Benjamin Korper. The company’s name is not in the Dutch police statement. Reuters also reported that ShinyHunters denied Van der Stap had any association with the group. His identity and alleged role remain unproven; his 2023 conviction for earlier data theft and extortion is not evidence that he took part in this investigation’s alleged offences.²⁶

ShinyHunters said it had stolen sensitive records belonging to FBI employees and job applicants, and claimed its haul covered almost all agents and applicants. The FBI has not confirmed that scale. The Register reported that journalists and security researchers who reviewed sample files found what appeared to be personal and job-related details, including addresses and Social Security numbers. Those samples do not establish how much data was taken or who was affected.³⁵

On 29 September, Leatherman made his public appeal to ShinyHunters. The group said it had no intention of publishing the alleged data and described its actions as a marketing campaign. That assurance is the group’s claim, not independent confirmation of what it holds or what will happen to any copied files.⁴

Dutch police also allege that information found on the man’s laptop pointed to an attempt to arrange two murders abroad. Police said that suspicion is separate from the ShinyHunters inquiry; they have not publicly released the underlying evidence. The court’s 90-day detention extension gives investigators more time to examine the seized devices, and police say further arrests have not been ruled out.¹

Footnotes

1. Dutch National Police, 29 September 2026 ↩ ↩² ↩³ ↩⁴

2. Reuters, carried by B97.5, 28 September 2026 ↩ ↩²

3. Associated Press, 29 September 2026 ↩ ↩²

4. Reuters, carried by WSAU, 29 September 2026 ↩ ↩²

5. Federal Bureau of Investigation, 23 September 2026 ↩ ↩²

6. Krebs on Security, 28 September 2026 ↩