ShinyHunters suspect held: 140+ breaches, $70M extortion

For cybersecurity teams, the ShinyHunters arrest is less a victory lap than a case study in failure modes. The alleged leader, Pepijn van der Stap, was a convicted cybercriminal who walked out of prison into a job at Dutch firm Neo Security — a reminder that insider risk can sit inside your own industry. Meanwhile, the group's playbook of compromising third-party cloud vendors and extorting victims with data-publication threats remains as relevant to defenders as ever, with the FBI's $70 million figure quantifying the scale of the threat.

The arrest of a 24-year-old Amsterdam man identified as Pepijn van der Stap is the most significant law-enforcement action to date against ShinyHunters, the cybercrime group behind some of the highest-profile data extortion campaigns of the past two years. Dutch National Police took the suspect into custody on September 15, 2026, and a Rotterdam court has ordered him held for at least 90 days pending trial. Authorities have not officially named him, but independent journalist Brian Krebs and Reuters identified him as van der Stap, who was convicted of data theft and extortion in 2023 and later took a role at the Dutch cybersecurity firm Neo Security after his release from prison.

“

Meanwhile, the group's playbook of compromising third-party cloud vendors and extorting victims with data-publication threats remains as relevant to defenders as ever, with the FBI's $70 million figure quantifying the scale of the threat.

FBI Assistant Director Brett Leatherman quantified the alleged operation in a video statement released Tuesday: the suspect and his co-conspirators have breached more than 140 organizations and collected at least $70 million in extortion payments since 2025. That scale explains why ShinyHunters is regarded as among the most prolific cybercrime groups in operation. Its victims span cloud platforms, healthcare providers, universities, technology companies, retailers and education-services firms, with named targets this year including Instructure, Salesforce, Snowflake and McKesson — alongside earlier, widely reported claims against Ticketmaster and Rockstar Games.

A crucial wrinkle is the timing. The arrest came about a week before ShinyHunters claimed to have broken into the FBI itself and stolen data containing sensitive information on nearly every FBI agent. Either the group continued operating without one of its alleged leaders — evidence of a decentralized, resilient structure — or the FBI-breach claim is opportunistic. ShinyHunters has already told Reuters that van der Stap has 'no association' with the group, a denial that is standard in the immediate aftermath of an arrest and should be treated with caution.

The van der Stap–Neo Security connection may be the most consequential subplot for the security industry. According to Krebs on Security, van der Stap joined the Dutch firm after his release from prison, effectively operating as a defensive security professional while allegedly helping run an extortion enterprise. If confirmed, it is a sharp reminder that insider threat and vetting failures are not limited to victim organizations; they can reside inside the companies entrusted with protecting them.

Equally striking is the allegation that evidence on van der Stap's laptop includes details about two murders he allegedly ordered abroad, described by Dutch police as attempted incitement to commit two murders. That detail blurs the boundary between financially motivated cybercrime and violent crime, and it raises the personal stakes for any co-conspirator weighing whether to cooperate.

The case also illustrates how cybercrime investigations increasingly unfold across borders. Dutch National Police executed the arrest, the FBI is leading the extortion case in the United States, and a Rotterdam court is now managing pre-trial detention — a coordination pattern that has become essential as groups like ShinyHunters operate globally, often from jurisdictions beyond their victims' reach.