· ·

ShinyHunters Arrests: What Dutch Police and the FBI Confirmed

No U.S. charges have been made public after Dutch and Jordanian ShinyHunters arrests. Here is what police, courts and the FBI have confirmed.

ByPeter
Glass padlock shattering inside a dark data center lit in blue and orange
AI-generated illustration

WASHINGTON — As of October 4, 2026, no U.S. indictment or criminal complaint against anyone arrested this year in connection with the ShinyHunters extortion group has been made public, based on the official statements, court records and news reports reviewed for this report. The ShinyHunters arrests announced so far are a Dutch arrest on September 15, publicized with the FBI on September 29, and a detention in Jordan that Reuters reported on October 3 and that Jordanian officials have confirmed in part. Earlier cases, including a U.S. conviction in 2024, are listed below with their exact status.

Analysis: the FBI has been the public voice of the latest arrests, but the legal proceedings that have been announced are Dutch. Readers should treat “FBI arrest” as shorthand for arrests by partner agencies that the FBI has publicly welcomed.

Timeline

  • April 2020 – July 2021: A user called ShinyHunters posted data from more than 60 companies for sale on criminal forums, according to a U.S. Justice Department release.
  • 2022–2023: A French national is arrested in Morocco in 2022 and extradited to the United States in January 2023 (Justice Department).
  • January 9, 2024: That man is sentenced in Seattle to three years in prison.
  • June 23, 2025: French police arrest four people suspected of running BreachForums and belonging to a collective called ShinyHunters, the Paris prosecutor said.
  • September 12, 2025: The FBI publishes a FLASH alert on Salesforce data-theft campaigns, noting extortion emails “allegedly from the ShinyHunters group.”
  • May 15, 2026: The FBI issues a public service announcement on ShinyHunters after an attack on an online learning-management system.
  • September 15, 2026: Dutch police arrest a 24-year-old man from Amsterdam.
  • September 22, 2026: ShinyHunters claims it breached an FBI jobs site and demands the FBI correct its May advisory (Reuters; SecurityWeek).
  • September 29, 2026: Dutch police announce the arrest; a Rotterdam court orders at least 90 more days of pretrial detention. The same day, a man is reportedly detained in Jordan, according to Reuters.
  • October 3, 2026: Reuters reports the Jordan detention; Jordanian state media quote an official confirming an arrest.

The Dutch arrest: what police and the court said

The Dutch National Police said in a September 29 statement that it arrested a 24-year-old man from Amsterdam on September 15. Police said he is suspected of “playing a role” within ShinyHunters and of participating in a criminal organization. The statement described ShinyHunters as a criminal hacking and extortion group involved in many large data breaches, including those at Odido, Pornhub and Ticketmaster.

Police also said a large amount of information on the man’s laptop concerned two murders to be committed abroad, and that there are indications he gave the order. He is therefore also suspected of attempted incitement of two murders. Police said that suspicion is separate from the ShinyHunters investigation. The Rotterdam District Court’s chambers ruled on September 29 that he stays in pretrial detention for at least 90 more days. Police said further arrests are not ruled out and that he was not arrested in the investigation into the Odido breach.

The FBI’s Cyber Division head, Brett Leatherman, described the man in a video as “one of the alleged leaders of ShinyHunters,” according to BleepingComputer. The Dutch police statement uses the narrower wording of a suspected role. No trial has been announced, and he is presumed innocent. TechCrunch reported that a ShinyHunters representative said the man identified in media reports “has no association with us.”

Reuters and KrebsOnSecurity have published names for the suspects in 2026. Peter’s World is not repeating them, because neither the Dutch nor the Jordanian authorities have named the men and no public charging document exists.

The Jordan detention: what is reported

Reuters reported on October 3, citing three people familiar with the matter, that a suspected ShinyHunters member was detained by Jordanian authorities, with two sources saying he was taken into custody on Tuesday, September 29. Two sources told Reuters he is helping the FBI and other agencies locate the group’s other members. Reuters said it could not determine where he is held.

Jordanian state television quoted an official on October 3 saying an arrest took place last week and that “investigations are ongoing with the suspect about the activities of the group,” according to The National. The official did not give the suspect’s identity. The FBI declined to comment on any specific arrest abroad, saying it has “worked with partners to arrest multiple subjects.” FBI Director Kash Patel wrote on X on September 30 that “More arrests are on the table.” No charges against this suspect have been reported. The claim of cooperation rests on anonymous sources and is not confirmed by officials.

Earlier cases and their status

The only U.S. conviction I found that the Justice Department ties to the ShinyHunters name is that of Sébastien Raoult. The Justice Department said he was arrested in Morocco in 2022, extradited in January 2023 and sentenced on January 9, 2024, in the Western District of Washington to three years in prison for conspiracy to commit wire fraud and aggravated identity theft. The court docket shows restitution of $5,058,419.73 and dismissal of other counts after a guilty plea.

In June 2025, Paris prosecutor Laure Beccuau said four suspects aged in their twenties were arrested on June 23 over BreachForums and the ShinyHunters collective; an investigating judge was to decide whether to send the case to trial, Infosecurity Magazine reported. I found no public report of an indictment, trial or release since then. Separately, a British man was charged in the U.S. over BreachForums-related hacking; that case is not a ShinyHunters charge.

What ShinyHunters is, and what the FBI says it does

The Justice Department’s 2024 release describes ShinyHunters as a user that sold stolen data on forums such as RaidForums and Exploit. By 2025 the name appeared on extortion emails. The FBI’s September 2025 FLASH said some victims of voice-phishing attacks on Salesforce accounts later received extortion emails allegedly from ShinyHunters. BleepingComputer reported that those behind the campaign called themselves “Scattered Lapsus$ Hunters,” claiming ties to ShinyHunters, Scattered Spider and Lapsus$. That is a self-description by the actors.

The FBI’s May 2026 announcement says ShinyHunters actors may use real or exaggerated claims of access to pressure victims, may harass victims and their relatives, and in some cases use swatting. ShinyHunters has publicly denied swatting and contacting victims’ families, per SecurityWeek. The FBI says, according to BleepingComputer, that the group and alleged co-conspirators have breached more than 140 organizations since last year and collected at least $70 million in extortion payments. Those figures are FBI assertions, not court findings.

What is verified, and what is claimed

Verified by official sources:

  • Dutch police arrested a 24-year-old Amsterdam man on September 15 and a court extended his detention on September 29.
  • He is suspected, not convicted, of participating in a criminal organization and of attempted incitement of two murders.
  • A Jordanian official confirmed a suspect is being questioned about the group.
  • The FBI says it is investigating claims about its jobs site and has worked with partners on arrests.
  • One ShinyHunters-named defendant was convicted in the U.S. (2024).

Claimed or reported by sources, not confirmed by authorities:

  • That the Jordan detainee is cooperating with the FBI (Reuters, anonymous sources).
  • That the Dutch suspect is a leader of the group (FBI wording; Dutch police say “a role”; the group denies a link).
  • The FBI-breach details: the group says it took two to three terabytes via an Oracle PeopleSoft flaw and denies seeking money. SecurityWeek quoted the FBI as saying it is “currently investigating.”
  • The extortion totals, which come from FBI statements, not court findings.

What it means for companies and users

Analysis: the ShinyHunters name has appeared on new intrusions in 2026, after the 2024 conviction and the 2025 French arrests, so the steps below do not depend on the outcome of any one case. The FBI advisories point to the same weak points. This is general guidance, not advice for a specific situation.

For companies:

  • Use phishing-resistant multi-factor authentication, as the FBI recommends.
  • Train help-desk and call-center staff to recognize voice phishing from callers posing as IT support.
  • Review third-party integrations and connected apps in SaaS tools, rotate tokens, and apply least privilege.
  • Monitor API use for bulk data pulls.

For individuals:

  • Verify unusual calls, texts or emails through a known channel.
  • Do not pay or respond to extortion demands, as the FBI advises.
  • Report incidents to ic3.gov.

All people named in this report as suspects or defendants are presumed innocent unless and until convicted.

Sources

More from Peter's World

Leave a Reply

Your email address will not be published. Required fields are marked *