Dutch police arrest suspected ShinyHunters leader tied to FBI and Ticketmaster breaches

Arrest in Amsterdam

Dutch police have arrested a 24-year-old Amsterdam man in connection with ShinyHunters, the hacking group behind high-profile attacks on Ticketmaster, Rockstar Games and, most recently, the FBI. According to The Verge, Dutch authorities announced the arrest in a press release and said it took place on September 15 — just days before ShinyHunters claimed to have breached the FBI's website and stolen employee data, a claim first reported by Reuters.

A named suspect and a denial

Neither the Dutch authorities nor the FBI have officially identified the suspect. However, The Verge reports that both Krebs on Security and Reuters name him as Pepijn van der Stap, a Dutch man convicted of data theft and extortion in 2023. Krebs on Security further reports that, following his release from prison last year, van der Stap took a job at the Dutch cybersecurity company Neo Security.

The group itself disputes the connection: ShinyHunters told Reuters that van der Stap has "no association" with it.

The Dutch police statement also adds a separate and more serious accusation, stating that the suspect is suspected of attempted incitement to commit two murders.

The FBI issues a warning

Brett Leatherman, assistant director of the FBI's Cyber Division, described the arrested man as one of the group's alleged leaders and used the moment to address its remaining members. In a video published Tuesday, Leatherman said: "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."

FBI Director Kash Patel wrote on X that bureau teams were already working with partners to pursue additional leads generated by the arrest, a signal that investigators expect the case to expand beyond a single person.

Why it matters

ShinyHunters has been linked to a string of headline-grabbing breaches, and the arrest of a suspected leader could disrupt the group's operations as well as the wider market for stolen data, where hauls from one intrusion are routinely resold and recycled into further fraud and extortion schemes.

The case also puts an uncomfortable spotlight on the security industry itself. A man reportedly convicted of data theft and extortion moved into a role at a cybersecurity firm after leaving prison, a detail that will fuel debate over how the sector vets people with criminal histories.

The timing deserves attention too: the claim of an FBI breach arrived days after the suspect was already in custody, which suggests either that remaining members kept operating or that the group's public claims warrant some skepticism. With the FBI promising more leads and, implicitly, more arrests, this investigation is unlikely to end here.