FBI sends warning to cybercrime group that hacked it after Dutch arrest of ‘leader’

On Tuesday, the FBI and Dutch authorities announced that an alleged "leader" of ShinyHunters had been arrested.Mandel NGan / AFP via Getty Images fileShareAdd NBC News to GoogleSept. 29, 2026, 2:21 PM EDTBy Kevin Collier, Ryan J. Reilly and Kelly O'DonnellDutch authorities and the FBI said Tuesday that Dutch law enforcement had arrested a leader of ShinyHunters, the international cybercrime group that last week claimed to have hacked an FBI website and stolen sensitive personal information on agents.

The bureau is not explicitly tying the Dutch man’s arrest to the FBI hack, which seemingly occurred after the man was detained, but is using it to warn other members of the ShinyHunters criminal ring.

In a video statement published to the FBI website, Cyber Division Assistant Director Brett Leatherman addressed the hackers directly and urged them to confess to law enforcement.

“To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague,” Leatherman said.

“Other groups believed anonymity or their friends would protect them and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” he said. “I suggest you reach out first while the choice is still yours.”

Leatherman did not directly address the FBI hack in his message to ShinyHunters.

Earlier on Tuesday, Dutch National Police announced that on Sept. 15 it had arrested a 24-year-old Amsterdam man suspected of being a ShinyHunters hacker. They said he is separately being investigated for allegedly ordering two murders abroad.

FOR SUBSCRIBERSThe complicated bargain between ‘looksmaxxing’ influencer Clavicular and the women in his orbitFOR SUBSCRIBERSSenators unveil bipartisan bill to deliver essential newborn supply kits to new momsFOR SUBSCRIBERSBig Tech’s AI agents are fighting over your shopping cartFOR SUBSCRIBERSDemocrats face a staggering spending disadvantage in Georgia’s tight race for governorFOR SUBSCRIBERSObama boosts Senate Democrats with October fundraiserFOR SUBSCRIBERSTheir owner is suspended, their draft picks taken. The Clippers still believe they can win.FOR SUBSCRIBERSMLB wants a salary cap for competitive balance. Does the playoff field already have it?FOR SUBSCRIBERSThe Data Dive: Steve Kornacki on whether Democrats can loosen Trump’s hold on IowaFOR SUBSCRIBERSFlorida’s record-breaking dengue fever outbreak was only a matter of time, experts sayFOR SUBSCRIBERSAnother, closer look at an alleged 2024 campus gang rapeFOR SUBSCRIBERSCustom cursors, GIFs and hand-coded widgets: The personal blog is backFOR SUBSCRIBERSHow Trump’s second term is reshaping U.S. funding for the United NationsFOR SUBSCRIBERSEurope’s far-right leaders try to shake their Putin ties as they near powerFOR SUBSCRIBERSLawmakers battle National Archives over plans to move historical Asian American recordsFOR SUBSCRIBERSHow disrupted sleep can affect breast cancer riskShinyHunters is a prolific cyber-extortion group with members from across the globe. It routinely hacks companies to steal sensitive data and then threatens to leak it onto the dark web unless they’re paid a fee.

Last week, ShinyHunters announced on its website it had hacked the FBI’s jobs portal site and stolen significant personal information on agents. The group demanded that the FBI retract a public service announcement about the group issued in May. It gave a deadline of Sept. 29 to do so, though it did not explicitly say it would publish the data it had stolen.

ShinyHunters breached the FBI on Sept.21, placing the hack after the Dutch man’s arrest. The group did not respond when asked about the arrest and Leatherman’s message.

FOR SUBSCRIBERSThe complicated bargain between ‘looksmaxxing’ influencer Clavicular and the women in his orbitFOR SUBSCRIBERSSenators unveil bipartisan bill to deliver essential newborn supply kits to new momsFOR SUBSCRIBERSBig Tech’s AI agents are fighting over your shopping cartFOR SUBSCRIBERSDemocrats face a staggering spending disadvantage in Georgia’s tight race for governorFOR SUBSCRIBERSObama boosts Senate Democrats with October fundraiserFOR SUBSCRIBERSTheir owner is suspended, their draft picks taken. The Clippers still believe they can win.FOR SUBSCRIBERSMLB wants a salary cap for competitive balance. Does the playoff field already have it?FOR SUBSCRIBERSThe Data Dive: Steve Kornacki on whether Democrats can loosen Trump’s hold on IowaFOR SUBSCRIBERSFlorida’s record-breaking dengue fever outbreak was only a matter of time, experts sayFOR SUBSCRIBERSAnother, closer look at an alleged 2024 campus gang rapeFOR SUBSCRIBERSCustom cursors, GIFs and hand-coded widgets: The personal blog is backFOR SUBSCRIBERSHow Trump’s second term is reshaping U.S. funding for the United NationsFOR SUBSCRIBERSEurope’s far-right leaders try to shake their Putin ties as they near powerFOR SUBSCRIBERSLawmakers battle National Archives over plans to move historical Asian American recordsFOR SUBSCRIBERSHow disrupted sleep can affect breast cancer riskWhile the full extent of what ShinyHunters stole from the FBI is unclear, a ShinyHunters spokesperson sent NBC News a sample document that included sensitive personal information about a former agent, who confirmed it was authentic.

According to a Justice Department notification to lawmakers obtained by NBC News, the FBI designated the matter a cybersecurity incident on Sept. 22. It said the affected system holds sensitive personal information, including Social Security numbers, dates of birth, phone numbers, addresses and emergency contact information, and that investigators are still working to determine how many people may have been affected.

ShinyHunters also claimed to have used its access to the FBI jobs portal to pivot and steal a cache of other information from multiple other agency programs, but did not provide evidence of those claims.

The FBI sent a message to employees on Friday saying they were working on the premise that personally identifiable information of employees may have been obtained, according to a person familiar with the communication, and to be vigilant and report any unsolicited contacts. The person said that some FBI employees were frustrated that they heard about the data breach from the media as well as what they saw as a slow response from the bureau.

“The FBI is working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted — including multiple Bureau wide communications within 24 hours of public reporting. The FBI treats the security of its information and the safety of its workforce as top priorities, and our investigation is ongoing,” an agency spokesperson said in a statement.

On Monday afternoon, before the FBI’s announcement, the ShinyHunters spokesperson told NBC News that it now was committed not to publish any data it had stolen from the agency. The spokesperson added a lengthy statement that indicated it was backing down from its demand the PSA be retracted.

“This was all a marketing campaign to protect our business and actively combat disinformation,” the statement said.

“This was not a threat. It may have been worded like a threat but ultimately the public has drove this story out of context and made their own wild assumptions and speculations,” it said. “We stand corrected.”

Kevin CollierKevin Collier is a reporter covering cybersecurity, privacy and technology policy for NBC News.

Ryan J. ReillyRyan J. Reilly is a justice reporter for NBC News.