A 24-year-old Amsterdam man alleged to lead the ShinyHunters cybercrime crew is now in custody after a joint strike by the FBI and Dutch authorities, and federal cyber leaders wasted little time telling the rest of the group the walls are closing in.
Fox News reported that the arrest came under Dutch law on Sept. 15, with FBI Director Kash Patel announcing the breakthrough and Cyber Division Assistant Director Brett Leatherman releasing a direct video warning to remaining members.
The case lands at the center of a larger fight against online extortion rings that have preyed on companies, government systems, and ordinary people who never signed up for this fight. Officials say the group is tied to cyberattacks in the United States, the Netherlands, and far beyond.
Dutch police also said the suspect faces a far darker accusation: attempted incitement to commit two murders. Investigators seized data carriers and made clear more arrests remain on the table.
Patel framed the operation as coordinated police work, not a one-off press hit. On Tuesday morning he posted that the FBI and Dutch National Police were announcing the arrest of one of the alleged leaders of ShinyHunters.
FBI Director Kash Patel wrote on X:
“This morning @FBI and our partners the Dutch National Police are announcing the arrest of one of the alleged leaders of ShinyHunters, a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world,”
He added that Dutch High-Tech Crime Unit officers made the arrest under Dutch law while FBI teams kept working fresh leads. Patel thanked Dutch partners and industry sources who shared information, then stressed the probe is still active.
That message fits a broader pattern of federal pursuit across borders, much like the FBI fraud crackdown that netted fugitives on three continents in schemes aimed at federal programs.
Lawful governments still have reach when they choose to use it. Cybercriminals count on distance, fake names, and soft targets. This arrest undercuts that bet.
Brett Leatherman, assistant director of the FBI’s Cyber Division, did not bury the message in a press release. He spoke straight to the remaining members of ShinyHunters in a public video address.
Brett Leatherman said in the video:
“To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague,”
He kept going. Leatherman said the FBI is confident those members have seen or heard things in recent days that the public has not. He warned that other groups once believed anonymity or friends would shield them, and they were wrong.
Leatherman continued:
“Arrests have a way of changing who is willing to talk. And seized infrastructure has a way of showing us who’s left.”
Then came the clearest line in the warning. He told them the longer they stay in the game, the more agents learn about them. He said they know how to find the FBI, and the FBI knows how to find them. His advice was blunt: reach out first while the choice is still theirs.
That kind of public pressure matters. It signals that federal cyber units are not content to draft after-action memos while extortion crews keep cashing out.
Leatherman also laid out the harm officials attribute to the crew. He said that since last year, this cyber criminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments.
Brett Leatherman stated:
“They often target third-party vendors and cloud-based platforms, stealing sensitive data in extorting victims with threats to publish it.”
That model is familiar to anyone who has watched ransomware and leak-site gangs operate. Hit a vendor. Steal the data. Threaten publication. Demand payment. Move on to the next target.
ShinyHunters reportedly listed the State of Florida DMV on a leak site and threatened to release allegedly stolen files if the agency did not respond. The group also claimed, in reporting cited by Reuters in the Fox News account, that it had stolen terabytes of sensitive personnel data from U.S. FBI servers. Those claims remain part of the public record of the group’s boasts, not a closed forensic finding in the materials here.
When criminals treat American agencies and state systems as ATMs, taxpayers and frontline workers pay the price. Federal action of this kind belongs in the same lane as other hard-edged enforcement pushes, including a DOJ sweep that charged 160 defendants in pandemic fraud cases with losses topping $245 million.
Crime that hides behind keyboards is still crime. The ledger runs into the tens of millions for a reason.
Dutch authorities did not limit the case to hacking. A Dutch police release said the man is also suspected of attempted incitement to commit two murders. That charge, if proven, moves the story well past data theft into a different category of threat.
The same release said various data carriers have been seized and are being investigated further. It also said further arrests are not ruled out.
Those details matter for anyone tempted to treat cybercrime as a victimless tech sport. Extortion crews do not operate in a vacuum. Money, leverage, and threats travel together. When police seize devices and keep the door open for more arrests, they are treating the network as a living enterprise, not a one-man stunt.
Cross-border cases also show what happens when American and allied agencies stay aligned. The same muscle memory appears in other high-stakes captures, including when the FBI extradited a Honduran fugitive wanted for 25 years in a child murder case out of Philadelphia.
Distance is not immunity. That is the point.
Benjamin Korper of Amsterdam-based cybersecurity firm Neo Security named the arrested man as Pepijn van der Stap, who worked there as offensive security lead. Korper said Dutch forensic investigators visited the company office the night of the Sept. 15 arrest and described a dramatic police raid that included flash bang grenades.
Korper said he had vetted and monitored Van der Stap. After the arrest, he hired an outside firm to check whether the employee had acted against the company or its clients. Korper said no evidence of that had been found so far. He also said he has not been in touch with Van der Stap since the arrest.
Benjamin Korper said:
“I truly believe that people deserve a second chance, but in this case I was not thanked for it,”
He added that absolutely everybody he talked to is flabbergasted.
The personal history makes the shock sharper. In 2023, Van der Stap had convictions for data theft and extortion. Afterward he publicly cast himself as someone who had learned a different path. On a personal website he acknowledged that his journey “hasn’t been a straight line,” but said experience taught that “knowledge is for building and protecting, not breaking.”
ShinyHunters, for its part, put out a statement saying Van der Stap had “no association” with the group and calling Dutch police incompetent. That denial now sits next to the arrest, the raid, the seized devices, and the FBI’s public warning.
Second chances are part of a free society. They are not a free pass when the same pattern of digital theft and extortion returns under a new flag.
The sequence is straightforward. Convictions in 2023. Public claims of reform. Alleged breaches of more than 140 organizations and at least $70 million in extortion payments tied by the FBI to activity since last year. Arrest in Amsterdam on Sept. 15. Office visit by Dutch forensic teams that same night. Patel’s announcement. Leatherman’s video. Ongoing leads and the open possibility of more arrests.
None of that requires melodrama. The record is enough. A group that thrived on stolen data and payment threats just lost a man authorities call one of its leaders. Devices are in government hands. Partners on both sides of the Atlantic are still working the case.
Federal agencies have shown they can move on complex targets when leadership prioritizes results, whether the case is cyber extortion or a domestic plot. Recent examples include the FBI arrest of an Albany woman in an alleged ISIS-inspired plot aimed at the New York State Capitol.
Different crimes. Same principle. Find the threat. Build the case. Make the arrest.
Key gaps remain. Dutch and FBI primary statements in the available account did not formally name the suspect the way Korper did. Exact charging documents beyond the alleged ShinyHunters role and the attempted murder-incitement claim were not laid out in full. The absolute calendar date of Patel’s “Tuesday morning” post was not pinned down beyond that relative marker. Independent public corroboration for the 140-organization and $70 million figures beyond Leatherman’s statement was not detailed in the package.
Those are real limits. They do not erase what officials did put on the record: an overseas arrest, seized media, a live investigation, and a public demand that remaining members come in before the choice disappears.
Identity theft and fraud schemes keep testing whether institutions will treat digital crime as serious crime. That is why cases like the FBI arrest of a man accused of paying Los Angeles homeless people to forge ballot petition signatures with stolen voter identities still matter to voters who expect clean process and real consequences.
Cyber extortion belongs in that same accountability file. If you steal data, threaten publication, and cash the checks, you should expect a knock on the door, even in Amsterdam.
Secure systems are not a luxury good for large companies. They protect payrolls, medical files, driver’s license records, and government personnel data. When gangs treat those systems as hunting grounds, the bill lands on workers, families, and taxpayers.
The right response is not a seminar on root causes. It is competent policing, allied cooperation, and a clear message that anonymity is temporary. Patel’s announcement and Leatherman’s video did that without apology.
Soft treatment of sophisticated theft only invites the next breach. Hard, lawful pressure invites the opposite: fewer willing partners for the next crew, more seized servers, and more suspects deciding the risk is no longer worth the payout.
ShinyHunters built a business model on fear and stolen files. Federal and Dutch officers just answered with an arrest warrant, a raid, and a warning aimed at everyone still hiding behind a screen name.
Law-and-order still works when leaders decide criminals, online or off, do not get the last word.
By signing up, you agree to receive newsletters and promotional content from American Frontline News and selected publications in the American Digest Media Network, operated with Patriot Mom Digest LLC, and you accept our Terms of Use and Privacy Policy. You may unsubscribe at any time.
By signing up, you agree to receive newsletters and promotional content from American Frontline News and selected publications in the American Digest Media Network, operated with Patriot Mom Digest LLC, and you accept our Terms of Use and Privacy Policy. You may unsubscribe at any time.