FBI Director Calls Dutch Arrestee an 'Alleged Leader' of ShinyHunters, Hacking Group Denies It

Since ShinyHunters claimed last Tuesday, September 22, that it had stolen two to three terabytes of data from the FBI's job-application portal, the case has moved from a hacking boast to an actual arrest with a name attached, even if authorities won't confirm it.

FBI Director Kash Patel posted on X Tuesday that the FBI and Dutch National Police had jointly arrested a suspect he described only as "one of the alleged leaders" of ShinyHunters. Patel did not name the person. "As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest," he wrote, according to CBS News.

The FBI said in a statement that it is "working around the clock to investigate the cyber incident involving FBIJobs.gov" and is in regular contact with people who may be affected.

Who's the guy in Rotterdam

Dutch police announced Monday, September 28, that a 24-year-old Amsterdam man had been arrested earlier this month in connection with the ShinyHunters investigation and would appear before the Rotterdam District Court on Tuesday, September 29, according to the Politie Landelijke Opsporing en Interventies. That court date is for a pretrial detention hearing, which determines whether the suspect stays in custody while the investigation continues. It is not a trial and no charges have been made public.

Dutch police did not name the suspect. But independent security journalist Brian Krebs, the outlet DataBreaches.Net, Dutch broadcaster RTL and other outlets identified him as Pepijn van der Stap, who goes by the online handle Umbreon, according to The Hacker News. Reuters reported the arrest itself happened on September 15, when forensic investigators visited the Amsterdam office of Neo Security, the cybersecurity firm where van der Stap works as offensive security lead, and made the arrest that night. Flashbang grenades were reportedly deployed during the operation, though it's unclear where.

Van der Stap was convicted in the Netherlands several years ago on hacking, data theft and extortion charges and served part of a four-year sentence, with one year suspended. He went on to work in legitimate security, first at the firm Hadrian and as a volunteer with the Dutch Institute for Vulnerability Disclosure, and told DataBreaches.Net in a 2023 interview that he had grown "paranoid about getting caught" even after going straight.

His boss at Neo Security, Benjamin Korper, told Reuters he was floored by the arrest. "Absolutely everybody I talked to is flabbergasted," Korper said, adding that he had vetted van der Stap carefully before hiring him and has now brought in an outside firm to investigate.

ShinyHunters says it's not him

ShinyHunters flatly denies any connection to the arrested man. "That individual has no association with us. Frankly, we are laughing," a group representative told The Hacker News and CBC News, accusing Dutch police of "chasing attention and public favour" after what it called the "massive embarrassment" of the February Odido breach, which affected 6.2 million customers of the Dutch telecom and which Dutch investigators are separately probing. The CBC reported the same representative called Dutch police "unskilled and incompetent."

Neither Dutch police nor the FBI has laid out any evidence tying van der Stap to ShinyHunters' activity, and no charge sheet has been released. Investigators have not said whether he is suspected of participating in the Odido intrusion or is the Dutch-speaking caller heard in an audio recording of that attack that police released September 8. A suspect being publicly identified by journalists and now effectively by an FBI director's social media post before any indictment raises a due-process concern, one that Korper's own shock at the arrest underscores.

What's disputed about the hack itself

Separately, there's a dispute over how ShinyHunters actually got into the FBI's system. The group told The Register and other outlets it exploited a zero-day vulnerability in Oracle PeopleSoft. But cybersecurity outlet Privacy Needle reported that security analysts believe the intrusion instead used a URL-encoding technique to slip past web application firewall rules meant to block a known flaw, tracked as CVE-2026-35273, rather than a never-before-seen exploit. That's a meaningfully different claim: a known, patchable vulnerability bypassed through a firewall gap is a different failure than a genuine zero-day, and it changes who's at fault for the exposure.

The New York Times reported Monday that FBI employees received an internal email acknowledging the breach as a cybersecurity incident and confirming personal data of some employees was stolen, though CBS News said it has not independently verified that memo's contents.

None of this settles who ran the FBI breach or whether the man in Rotterdam had anything to do with it. The custody hearing Tuesday will decide whether he remains detained while Dutch and U.S. investigators keep working the case Patel says is still active.