Dutch police arrest suspected member of group that claimed FBI hack

29 September 2026, 16: 02 BST. Updated 4 hours ago.

Key points

• Stan Duijf, who leads Dutch investigations into cybercrime, remarked in an official note: The ShinyHunters group is responsible for numerous national and international victims.
• In an official note, Dutch police remarked it had arrested a 24-year-old man from Amsterdam on suspicion of being part of the group.
• The suspect was arrested on 15 September, before the alleged FBI attack.
• After the arrest, Brett Leatherman, assistant director of FBI Cyber, called on members of the group to hand themselves in "while the choice is still yours".
• ShinyHunters asserted to have breached the FBI's servers on 21 September and began contacting reporters the next day sharing samples and screenshots of the stolen data.

Dutch police have arrested a suspected member of the ShinyHunters cyber-crime group that asserted to have stolen sensitive information on all FBI bureau staff – around 38, 000 residents.

After the alleged attack last week, the group asserted to have every agent's name, role, badge number and personal details including home address and phone numbers.

In an official note, Dutch police remarked it had arrested a 24-year-old man from Amsterdam on suspicion of being part of the group. It has additionally asserted other hacks.

Notably, the suspect was arrested on 15 September, before the alleged FBI attack. He is additionally suspected of attempted incitement to commit two murders, police stated.

Police remarked they seized his devices and identified a "large amount of information" on his laptop, including "details about two murders that were to be committed abroad" that they suspect he may have ordered.

Meanwhile, the suspect has been held since his arrest. Dutch authorities have not ruled out further arrests.

"It is good that we have been able to arrest a suspect in the investigation into this group."

Taking to X, FBI director Kash Patel thanked Dutch partners and remarked: "As we speak, FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest."

He continued: Other groups believed anonymity or their friends would protect them. But arrests have a way of changing who is willing to talk.

"The longer you stay in this, the more we learn about you, you know how to find us, we know how to find you."

Meanwhile, the BBC has seen a small portion of the data. It appears to be genuine.

ShinyHunters is an international collective of hackers, believed to have originally began in France. It has been behind a number of high-profile breaches including on Rockstar Games in April and a highly disruptive hack on education platform Canvas in May.

In practice, the group claims to have discovered a vulnerability in the Oracle cloud storage system employed by the FBI to breach multiple systems including FBIJOBS, FBI BEAST. It does background checks on employees and applicants, FBI MedLink, which holds agent's medical records, and FBI BICS, which holds investigation information.

In its message on the dark web, the group remarked it did not hack the FBI system for capital.

Instead, the cyber-criminals asked the agency to retract an advisory that it issued in May regarding the gang, saying it was "offended" by its characterisation.

For context, the public service announcement, external. It is still up on the FBI's website, described ShinyHunters as "threat actors" who often "use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims".

"They target major companies across tech, finance, and retail, often stealing millions of customer records at once, " the advisory remarked.

Taken together, the developments around dutch police arrest suspected member of group that claimed FBI hack point to a situation that is still moving, and the coming days should bring more clarity.