The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested

The FBI has publicly told the remaining members of the ShinyHunters extortion group to contact the bureau before it contacts them. The appeal came from Cyber Division Assistant Director Brett Leatherman, in a video posted September 29, days after Dutch police announced the arrest of a 24-year-old man from Amsterdam described as an alleged leader of the group.

Leatherman’s pitch was short: the members know how to reach the bureau, and the bureau knows how to reach them.

Leatherman’s message to the rest of the crew

As Nextgov/FCW reported, Leatherman told remaining members that arrests and seized infrastructure expose identities and raise scrutiny. Staying in the group, he said, only lets investigators learn more about each member, and he urged them to “reach out first” while the decision is still theirs to make. The video was posted on YouTube on Tuesday, the same day the Dutch authorities went public with the arrest.

The FBI frames the group by its footprint, and the figures are the bureau’s rather than court findings. Leatherman said, in the wording CyberScoop quoted, that since last year the arrested man and his co-conspirators “have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments.” CyberScoop lists targets across cloud platforms, healthcare, universities, technology firms and retailers, naming Instructure, Salesforce, Snowflake and McKesson. FBI Director Kash Patel added that FBI teams were working with partners “to obtain and execute more leads in the ongoing investigation based on this arrest.”

The Amsterdam arrest and the Rotterdam court

BleepingComputer’s account says Dutch National Police arrested the man on September 15 and that a large amount of information was found on his laptop afterward. The Rotterdam District Court ordered him held in pre-trial detention for at least 90 days. CyberInsider reports that the court considered his detention again on September 29 and that police seized several data storage devices at the arrest.

BleepingComputer describes the group’s usual approach as going after corporate single sign-on accounts, cloud platforms such as Salesforce and Snowflake, and third-party vendors that hold customer data, then demanding payment to keep the stolen records private. The FBI’s count of more than 140 organizations, rather than individual victims, follows from that pattern.

The Dutch case is separate from any American charge, and the man has not been convicted of anything in the material reviewed for this article. CyberScoop and BleepingComputer both report that the material on his laptop included details of two murders he is suspected of ordering abroad, an allegation that remains at the level of suspicion in a pre-trial detention order. The Netherlands’ police force posted that a 24-year-old Amsterdam man had been arrested this month in a ShinyHunters investigation and that he was to appear before the Rotterdam court on Tuesday, September 29.

The FBI breach claim and the group’s retreat

The surrender appeal landed in the middle of an embarrassing week for the bureau. On September 22 ShinyHunters claimed it had exploited a zero-day in Oracle PeopleSoft to take 2 to 3 terabytes from FBI systems, including employee records, and posted screenshots of what looked like access to a recruitment portal. According to CyberInsider, the FBI later acknowledged a cybersecurity incident involving employees’ Social Security numbers and addresses.

Gizmodo described the same video alongside the group’s earlier breach of the bureau, which it said included the defacement of the FBI’s jobs portal with a mock takedown notice, and an internal FBI memo obtained by the New York Times said the agency was operating on the premise that the group had accessed complete employee personal data.

By September 29 the group had changed its tone. A spokesperson said, “This was not a threat. It may have been worded like a threat,” removed the FBI listing from its extortion site and told Nextgov/FCW it would not publish the broader trove, calling the confrontation a “marketing campaign.” Gizmodo adds that the group denied any connection to the arrested Dutch man, which leaves the FBI’s description of him as an alleged leader as an allegation rather than an established fact. Nextgov noted that experts caution the data could still be sold to foreign intelligence services, and CyberInsider points out that the retreat leaves open whether the group still holds the material.

The bureau’s wording is also notable for what it leaves out: it offers no deal, no named point of contact and no deadline in the reports cited. Leatherman’s video is the only public statement from the bureau that the reports cite, and none of them links to a written FBI release. What remains unconfirmed is the size of the group. Leatherman’s “rest of ShinyHunters” implies others beyond the one detained man, but none of the cited reports says how many people the FBI believes are involved or whether anyone has responded to the invitation to come forward.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview