Key Takeaways
Dutch police arrested Pepijn van der Stap, 24, a suspected member of the data-extortion group ShinyHunters, and a court ordered him held for 90 days.
ShinyHunters has stolen data from dozens of organizations, including 6.2 million records at Dutch telecom Odido and files on more than 5,000 FBI officials.
Researchers project the group's 2026 extortion demands could reach $100 million, and a Dutch outlet reported the suspect is tied to two alleged murder plots.
Dutch police arrested Pepijn van der Stap, a 24-year-old from Almere, as part of the investigation into ShinyHunters, the data-theft and extortion collective, according to Krebs on Security and the Washington Post. A court ordered him held for 90 days.
ShinyHunters has mass-exploited software flaws to steal data from dozens of systems across technology, healthcare, education, and government. It typically steals login credentials and then demands payment to keep the data private. The group took 6.2 million people's records from Dutch telecom Odido and the personal files of more than 5,000 FBI officials, including Social Security numbers and psychiatric records, Krebs on Security reported. Investigators have described the FBI breach as a major incident. Researchers project its extortion demands could total $100 million in 2026.
Van der Stap was convicted in 2023 for data theft and extortion that earned between 1.5 and 2.7 million euros, and released from prison in December 2025. Dutch police arrested him around September 16, and the case became public this week as the court ordered his detention. He had since presented himself as a reformed security professional. Dutch outlet RTL reported that investigators suspect he tried to arrange at least two murders abroad, and TechCrunch reported the same allegation.
The pattern here is hard to ignore. The same automated, cross-border breaches that drained a crypto exchange in the $387.5 million Bitget hot-wallet hack and moved money through a $16 million pig-butchering scam now reach federal personnel files, and the money moves faster than any single agency can trace it. Worth watching whether the arrest exposes the rest of the group.
People Also Ask
What is ShinyHunters?
ShinyHunters is a hacker collective known for mass data theft and extortion, breaching organizations across technology, healthcare, education, and government.
Who is Pepijn van der Stap?
He is a 24-year-old from the Netherlands, arrested as a suspected ShinyHunters member, previously convicted of data theft and extortion in 2023.
What was the FBI jobs portal breach?
It was a theft of personal files on more than 5,000 FBI officials, including Social Security numbers and psychiatric records, tied to the group.
How much has ShinyHunters made from extortion?
Researchers project the group's extortion demands could reach $100 million in 2026.
Sources
Krebs on Security, Washington Post, TechCrunch, The Hacker News.