ShinyHunters defaced the FBI's jobs site a week after Dutch police held an alleged leader
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
The Product Desk
What happened
- The FBI and Dutch authorities blame ShinyHunters for hacks on more than 140 organizations, including Pornhub, Ticketmaster and AT&T.
- ShinyHunters says it took 2 to 3 terabytes of data on FBI employees and job applicants, with samples showing names, addresses, phone numbers, assignments and family details.
- Reuters named the suspect as Pepijn van der Stap of Neo Security, who was convicted in 2023 over data theft and extortion and released from prison in December 2025.
- Dutch police are also investigating him over two murders planned abroad, based on information found on his laptop, in a case they call separate from ShinyHunters.
- A Rotterdam court has ordered him held for another 90 days.
Why it matters
- What doesn't add up contradiction Krebs's report that the Umbreon image may have been planted cuts against the FBI's 'leader' label, and the people directing the group's current attacks have not been publicly identified.
- Who's exposed exposure People who only applied for FBI jobs sit in the claimed data next to agents, and the counterintelligence risk from leaked blood, urine and psychiatric records stays open whatever the Dutch court decides.
- Who has to decide decision For companies deciding what this arrest changes, the group's entry routes are what to plan around, since both routes it has described run through vendor services or public portals.
Next story · Security · Oct 9
Arrests of ShinyHunters suspects reach at least three in two weeks after FBIjobs.gov breachConfirmed14 publishers
On September 22 the FBI's jobs website showed a message claiming the site had been "seized." The agency's imagery had been swapped for Umbreon, a black Pokemon with yellow rings [14]. Umbreon was the alias Pepijn van der Stap used when he sold stolen databases on cybercrime forums, and his old avatar showed the same Pokemon [15]. He was already in Dutch custody when the image went up [1]. KrebsOnSecurity reported that the current ShinyHunters operation may have used it to pin the FBI hack on him. Nobody has independently confirmed that theory [16].
The story a team tends to tell itself after an arrest headline is short: the leader is held, so the campaign stops. The people closest to the case describe him in different terms. FBI Director Kash Patel called him "one of the alleged leaders" of the group [21]. A ShinyHunters representative told TechCrunch he "has no association with us" [20]. Neo Security, where he worked, said investigators found no evidence he hacked the company or its clients [3]. Dutch police arrested him for "participating in a criminal organization" [12].
The FBI says it will go after the rest of the group [5]. Brett Leatherman, assistant director of its Cyber Division, addressed them directly. "You know how to find us, and we know how to find you," Leatherman said. "I suggest you reach out first while the choice is still yours." [4]
ShinyHunters is accused of stealing data and threatening to publish it unless the victim pays [7]. Both entry routes it has described start in vendor-run or public-facing systems. It said it reached Rockstar Games data in April through a third-party service connected to Snowflake [18]. Rockstar said only a limited amount of non-material company information was accessed [19]. The group said it took the FBI data through the careers website and job application portal [23]. The FBI is still investigating whether that intrusion began in its own systems or at a third-party provider [8]. The group says the FBI attack was not about money. It wants a May advisory that describes it as a data theft, extortion, harassment and swatting operation withdrawn, and the advisory is still online [11].
For the person deciding on Monday what this arrest changes, I'd sort outside systems on two axes. The first is whether the system holds personal data people typed in themselves, such as job applications or customer records. The second is whether someone other than your own team administers the login or connector that reaches it. A system that meets both conditions looks like the two entries the group has described. One was a vendor service tied to a data warehouse [18]. The other was an application portal where the FBI has not ruled out a third-party provider [8]. Systems in that corner go to the front of the credential and connector review, and systems that meet one condition can wait for the normal cycle. The cost is slow, manual work on vendor access, and the public evidence for doing it before the Dutch case resolves is a defacement dated seven days after the arrest [17].
What to watch
- Whether the FBI finds that its jobs portal breach began in its own systems or at a third-party provider.
- Whether ShinyHunters publishes the FBI employee and applicant data after telling TechCrunch it would not.
- Whether Dutch prosecutors tie Van der Stap to specific intrusions or seek custody beyond the current 90 days.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence58
Perspective Coverage
3 publishers- Builder
- Builder 13%
- Operator
- Operator 69%
- Investor
- Investor 18%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Dutch authorities say the suspect was detained on September 15, before ShinyHunters publicly claimed the FBI hack on September 22.
- [2]
Reuters reported the suspect is Pepijn van der Stap, an offensive security lead at Amsterdam-based Neo Security, who was convicted in 2023 over data theft and extortion offenses and released from prison in December 2025.
- [3]
His former employer, Neo Security, said investigators have found no evidence that he hacked Neo Security or its clients.
- [4]
"You know how to find us, and we know how to find you," Leatherman said. "I suggest you reach out first while the choice is still yours."
- [5]
Brett Leathermann, the FBI's cyber division lead, vowed that the bureau would go after the rest of the hackers following the arrest.
- [6]
The FBI and Dutch law enforcement say ShinyHunters is responsible for hacks on over 140 organizations around the world; Dutch authorities said the gang is accused of data breaches at Pornhub, Ticketmaster and AT&T.
- [7]
ShinyHunters is accused of hacking into companies to steal reams of data and then threatening to publish the data if victims do not pay a ransom.
- [8]
The FBI has not confirmed the full scope or source of the alleged breach and said it was investigating whether the intrusion began within its own systems or through a third-party provider.
- [9]
Dutch police said a lot of information was found on his laptop, including about two murders that should be committed abroad; he is being investigated for attempting to orchestrate them, which authorities said is separate from the ShinyHunters investigation.
- [10]
A Rotterdam court has ordered him held for another 90 days.
- [11]
ShinyHunters said the FBI attack was not financially motivated and demanded that the FBI retract or remove a May advisory describing the group as a cybercriminal organization involved in large-scale data theft, extortion, harassment and swatting; the advisory remains online.
- [12]
Dutch police say the man was arrested for "participating in a criminal organization," referring to ShinyHunters.
- [13]
The hackers told TechCrunch they will not publish the stolen FBI data.
- [14]
On September 22, ShinyHunters defaced the FBI's jobs website with a message claiming the site had been "seized" and replaced agency imagery with an image of Umbreon, a Pokemon known for its black body and yellow rings.
- [15]
Van der Stap previously used the alias "Umbreon" while selling stolen databases on cybercrime forums, and his old avatar featured the same Pokemon.
- [16]
KrebsOnSecurity reported that the Umbreon image may have been used by the current ShinyHunters operation to pin the FBI hack on Van der Stap; the theory has not been independently confirmed.
- [17]
The FBI jobs site defacement came seven days after the suspect's detention.
- [18]
ShinyHunters said it accessed Rockstar Games data in April through a third-party service connected to Snowflake and threatened to publish the information unless its demands were met.
- [19]
Rockstar confirmed that a limited amount of non-material company information had been accessed and said the incident had no impact on its players.
- [20]
A representative of the ShinyHunters group told TechCrunch that Van der Stap "has no association with us."
- [21]
FBI Director Kash Patel described the suspect as "one of the alleged leaders" of ShinyHunters.
- [22]
ShinyHunters claimed it stole between 2 and 3 terabytes of data involving FBI employees and job applicants, and provided samples that included names, addresses, phone numbers, assignments and family information.
- [23]
ShinyHunters said it took personal and sensitive data belonging to "mostly all" of the FBI's agents and applicants by breaching its careers website and job application portal.
- [24]
Among the sample of about 5,000 agents whose data was stolen from the portal, reporters found data relating to agents' blood and urine samples and psychiatric reports, sparking fears of a counterintelligence challenge.
Sources
3 independent publishers whose own reporting we read for this story.
- dexerto.comFBI says ShinyHunters leader arrested as Pokemon-themed hacking group faces probe
1 article · September 29, 2026
- techcrunch.comDutch police arrest ShinyHunters hacker accused of planning two murders
2 articles · September 29, 2026
- theverge.comSuspected ShinyHunters leader arrested in the Netherlands
1 article · September 29, 2026
Topics and entities
Topics
- Cybercrime Law Enforcement Operations
- Third-party breach
- Data Extortion
Entities
- Kash Patel
- Dutch High Tech Crime Unit
- Snowflake
- ShinyHunters
- KrebsOnSecurity
- Federal Bureau of Investigation
- Rockstar Games
- Pepijn van der Stap
- Brett Leatherman