Dutch authorities arrest ShinyHunters suspect as FBI investigates jobs site breach

Dutch authorities have arrested a suspected ShinyHunters leader as the FBI investigates the cybercrime group’s claim that it hacked the bureau’s jobs website and stole personal information. The FBI announced the arrest Tuesday but did not link the suspect to the breach, which NBC News said occurred after he was detained.

The 24-year-old Amsterdam man was arrested Sept. 15 on suspicion of involvement with ShinyHunters, Dutch National Police said. CBS News identified him as Pepijn van der Stap, citing sources familiar with the case. Dutch authorities said he is also being investigated on suspicion of attempting to incite two murders abroad, a separate allegation.

Dutch authorities said they seized data-storage devices and found a large amount of information on the suspect’s laptop. CBS News reported that the laptop contained details about the two alleged murder plots. Authorities said further arrests were possible. According to CBS News, the suspect is being held in isolation, may speak only with his lawyer during the investigation and is expected to remain in pretrial detention for at least 90 days.

ShinyHunters claimed last week that it had breached FBIJobs.gov and stolen sensitive information. According to NBC News, the breach occurred Sept. 21, six days after the arrest. The group claimed it had obtained two to three terabytes of data relating to FBI and Justice Department workers and had accessed other agency systems, CBS News reported. NBC News said the group provided no evidence for its claims about those other systems. The full extent of the data theft remains unclear.

A ShinyHunters spokesperson sent NBC News a sample document containing sensitive personal information about a former FBI agent, who confirmed it was authentic. A Justice Department notification to lawmakers obtained by NBC News said the affected system holds Social Security numbers, dates of birth, phone numbers, addresses and emergency contact information. Investigators are still determining how many people may have been affected.

The FBI designated the breach a cybersecurity incident Sept. 22, according to the notification. In a statement, the bureau said it was “working around the clock” to investigate and was communicating with people who may be affected. CBS News reported that employees were advised to take heightened security precautions and report suspicious contacts, harassment or threats.

FBI Cyber Division Assistant Director Brett Leatherman said Tuesday that the suspect and his alleged co-conspirators had breached more than 140 organizations since last year and taken at least $70 million in extortion payments. Addressing other ShinyHunters members in a video, he said: “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. I suggest you reach out first while the choice is still yours.” He did not directly address the FBI breach.

ShinyHunters had demanded that the FBI retract a May public service announcement about the group by Sept. 29. But a spokesperson told NBC News on Monday that the group would not publish data stolen from the agency and indicated it was dropping the demand. “This was all a marketing campaign to protect our business and actively combat disinformation,” the spokesperson said. “We stand corrected.”