FBI Urges ShinyHunters Members to Surrender After Dutch Arrest

Summary
Dutch police arrested a 24-year-old alleged ShinyHunters leader. The FBI says the group and alleged co-conspirators breached over 140 organizations and collected at least $70 million; the group’s claimed FBI data theft remains attributed to the attackers.
Key points
- Dutch police arrested a 24-year-old Amsterdam man on September 15, suspected of involvement in ShinyHunters and a criminal organization; he was ordered held in pre-trial detention for at least 90 days.
- The FBI says ShinyHunters and alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments.
- The FBI is urging remaining group members to surrender and says investigators are continuing to gather information about those involved.
- The article says ShinyHunters commonly targets corporate SSO accounts, third-party vendors, and SaaS platforms to steal data and threaten publication.
- ShinyHunters claimed it stole two to three terabytes from FBI systems, allegedly through an Oracle PeopleSoft zero-day, and shared a sample of about 5,000 personnel records with media.
- BleepingComputer reports that 404 Media and Reuters described exposed FBI personnel information, while the group claimed the attack was not financially motivated. Dutch police said the arrest was unrelated to the Odido investigation.
Article Details
- Event Type
- Arrest of an alleged ShinyHunters leader and FBI public warning urging remaining members to surrender
- Impact
- The FBI says ShinyHunters and alleged co-conspirators breached more than 140 organizations and collected at least $70 million in extortion payments. The group claimed it stole 2–3 terabytes of data from FBI systems, including personnel records; those breach claims are attributed to the group and reporting cited in the article.
People
Threat Actors
Vendors
OracleThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.SalesforceThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.SnowflakeThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.
Products
Oracle PeopleSoftThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.SalesforceThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.SnowflakeThe group is accused of breaching more than 140 organizations, including the FBI itself, while targeting platforms like Salesforce, Snowflake, and Oracle PeopleSoft.
Countries
Netherlandsone of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world,” FBI Cyber Division Assistant Director Brett Leatherman said in a video releasedUnited Statesthe arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world,” FBI Cyber Division Assistant Director Brett Leatherman said
