The FBI has issued a public warning to members of the ShinyHunters extortion group, urging them to surrender following the arrest of an alleged leader by Dutch police. Brett Leatherman, Assistant Director of the FBI's Cyber Division, stated in a video released Tuesday that the Dutch National Police apprehended a 24-year-old man from Amsterdam on September 15. This individual is suspected of involvement with ShinyHunters and participation in a criminal organization.
Dutch authorities confirmed the arrest, noting that a significant amount of information was discovered on the suspect's laptop, including details related to two planned murders abroad, which the suspect is believed to have ordered. The Rotterdam District Court has ordered the suspect to remain in pre-trial detention for an additional 90 days, and further arrests have not been ruled out. However, Dutch police clarified that this arrest is not connected to the investigation into the ShinyHunters breach of the Dutch telecom provider Odido.
The FBI attributes over 140 organizational breaches to ShinyHunters and its alleged co-conspirators since last year, with an estimated $70 million in extortion payments collected. The group typically targets corporate single sign-on (SSO) accounts, third-party vendors, and cloud-based Software-as-a-Service (SaaS) platforms, such as Salesforce and Snowflake, to exfiltrate sensitive data before demanding payment under threat of public disclosure.
This public warning comes shortly after ShinyHunters claimed responsibility for a data breach at the FBI itself. The threat actors alleged that this breach involved exploiting an Oracle PeopleSoft zero-day vulnerability. ShinyHunters claimed to have stolen between two and three terabytes of data from FBI systems, including information linked to various internal services.
To substantiate their claims, ShinyHunters provided a sample of approximately 5,000 FBI personnel records to media organizations. While some outlets declined to publish the data, reports indicated that the stolen information included names and personal details of members of the FBI's Remote Operations Unit, a secretive team involved in hacking operations. Concerns were raised as some of the exposed personnel were reportedly assigned to investigations involving China and Russia, highlighting the sensitivity of the compromised information.
Despite the sensitive nature of the data, ShinyHunters asserted that the FBI attack was not financially motivated, an extortion attempt, or intended for data publication. Instead, the group claimed the action was a direct response to an FBI advisory. This advisory had stated that ShinyHunters actors might exaggerate their access to sensitive information, harass victims and their relatives, conduct swatting attacks, and falsely claim to possess compromising material.
In his video address, Leatherman directly appealed to the remaining members of ShinyHunters. He indicated that investigators are actively gathering information on those involved and are targeting them. He warned that anonymity and associates would not provide protection, citing that arrests often lead to cooperation and seized infrastructure reveals remaining members.
Leatherman urged the remaining members to contact authorities while they still have the choice, stating, "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."
