The FBI publicly called on members of the ShinyHunters extortion group who remain at large to turn themselves in, following the arrest of a suspected member in the Netherlands, BleepingComputer reported Tuesday. The appeal came in a video from Brett Leatherman, assistant director of the bureau's Cyber Division, and the group responded with a defiant statement.

What Happened

Leatherman spoke directly to the group's remaining members. He told them they had heard about their colleague's arrest and suggested they had seen signs in recent days of investigative activity the public had not. The longer they stayed involved, he said, the more the FBI would learn about them, and seized infrastructure tends to expose who is left. He urged them to "reach out first while the choice is still yours," according to The Register, and pointed to other groups whose members had counted on anonymity or loyalty and were proved wrong.

The FBI said ShinyHunters and its co-conspirators have breached more than 140 organizations since 2025 and collected at least $70 million in extortion payments. The group typically goes after corporate single sign-on accounts, third-party vendors and cloud software platforms such as Salesforce and Snowflake, steals data and then threatens to publish it unless victims pay.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

FBI Director Kash Patel said federal agents assisted the Dutch investigators who made the arrest and that more arrests are possible, The Register reported.

The Group's Response

ShinyHunters did not back down. A spokesperson told The Register that the group's recent intrusion into FBI systems was not financially motivated and that it wanted the bureau to correct or retract what it called false allegations. The spokesperson described the group's activity as a game and said it was protecting its business as any other business would.

The group has claimed it took 2 to 3 terabytes of data from the FBI, including personnel records, by exploiting a zero-day flaw in Oracle PeopleSoft behind the FBIJobs.gov portal. Those figures come from the group and have not been independently verified.

Why It Matters

A public appeal of this kind signals that investigators believe they are close to identifying more members, and it is intended to exploit the uncertainty an arrest creates inside a loosely organized group. ShinyHunters' campaigns against SaaS platforms have reached a large number of companies through a single stolen login or compromised vendor, so pressure on its remaining members has consequences for many potential victims.

The $70 million figure also puts an official number on how profitable the group's extortion model has been, beyond the group's own boasts.

Background

Dutch police arrested a 24-year-old Amsterdam man on Sept. 15, identified by journalists as Pepijn van der Stap. Police said his laptop contained information about two murders planned abroad, with indications that he ordered them, and a Rotterdam court has ordered him held for at least 90 days while two separate investigations proceed.

What to Watch

Investigators are working through seized devices and infrastructure, and Patel has said more arrests are possible. Loose-knit extortion crews have a history of rebranding or folding into other groups after arrests rather than disappearing, so the next test is whether ShinyHunters' leak-and-extort activity actually slows.