Dutch police have arrested a 24-year-old Amsterdam man accused of helping to lead ShinyHunters, the cyber-extortion group blamed for data thefts across Europe and the United States.
Officers from the Dutch National Police’s High Tech Crime Unit detained the suspect at his home on September 15 on suspicion of taking part in a criminal organisation. The arrest was made public only on September 29, when the man appeared in court and was remanded in custody for at least 90 days.
Police said a large quantity of material was recovered from his laptop, including information about two murders that were to be carried out abroad. He is being investigated separately over an alleged attempt to have those killings committed.
The force did not name him. The Amsterdam cybersecurity company Neo Security identified him to Reuters as Pepijn van der Stap, its offensive security lead, and said forensic investigators visited its offices on the night of the raid.
The FBI, which supported the operation, presented the Dutch-led arrest as a template. Brett Leatherman, assistant director of the bureau’s cyber division, said the case showed a model in which “the partner with the strongest authority and access leads”.
Leatherman said the suspect and his alleged accomplices had breached more than 140 organisations since last year and extracted at least $70 million (€61.7 million) in extortion payments, frequently by targeting third-party vendors on cloud platforms.
The arrest came six days before ShinyHunters claimed to have broken into FBIJobs.gov, the bureau’s recruitment site, and to have taken between two and three terabytes of data on serving employees and applicants, including home addresses, telephone numbers and family details.
The group threatened to publish the material unless the bureau withdrew a report on an earlier attack against an online learning platform that disrupted teaching at American schools and universities.
ShinyHunters denied that van der Stap had any association with it and dismissed the Dutch investigation as incompetent. Police have said the arrest does not form part of their separate inquiry into the breach of Odido, the largest Dutch mobile operator, which exposed the records of millions of customers.
The group has also been linked to intrusions at Ticketmaster, AT&T and Pornhub, and to a wave of extortion attempts against companies using Salesforce systems.
European governments have faced a run of comparable attacks, among them a data breach affecting 19 million Poles that went undetected for two years and the theft of records belonging to nearly 700,000 French taxpayers.
Leatherman said the bureau was working with partners to pursue further leads arising from the arrest, and the Dutch police have not ruled out additional detentions.
