FBI Director Kash Patel confirmed the arrest on social media, describing the suspect as one of the alleged leaders of the group. Patel stated that the Dutch High-Tech Crime Unit made the arrest in coordination with FBI investigators. “As we speak, FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” Patel said. While the formal Dutch police statement did not explicitly reference the recent FBI breach or US coordination, the joint announcement underscores the international scope of the probe.
The timing of the arrest coincides with ShinyHunters’ claim of compromising the FBIJobs.gov portal. The hacker group stated it had stolen “very sensitive data” belonging to thousands of agents and applicants, including Social Security numbers and personal information. The FBI confirmed it is “actively and aggressively investigating” the incident. In a message directed to FBI leadership, ShinyHunters demanded the bureau remove a May advisory that described the group as a “cyber criminal group specializing in large-scale data breaches and extortion,” giving them one week to comply.
Van der Stap is a known figure in the cybersecurity community. He was previously convicted in 2023 for a string of data thefts and extortions that prosecutors said generated between €1.5 million and €2.7 million. During his trial, he admitted to using the hacker handle “Umbreon” to sell stolen data on underground forums while working by day as a software engineer at the Amsterdam-based cybersecurity startup Hadrian. He was sentenced to four years in prison, with one year suspended, and was released in December 2025. Prior to his recent detention, Van der Stap was employed as an offensive security lead at the Dutch company Neo Security and had described himself as a reformed hacker seeking to make amends for his past actions.
ShinyHunters has been responsible for a large number of victims in the Netherlands and abroad. A significant recent intrusion involved the Dutch telecommunications provider Odido, where the group used social engineering to steal data on more than 6.2 million Dutch people. Dutch authorities had previously asked the public to help identify a voice in a recorded call related to that breach. Following the recent arrest, ShinyHunters issued a statement supporting its detained member, asserting that the group provides “emotional, mental, and financial” support to its staff and has arranged for a criminal defense lawyer. The group also issued threats against Dutch police, describing them as “incompetent” and predicting further large-scale data thefts.
Detectives seized data storage devices during the raid on the suspect’s residence and are currently analyzing the contents. Authorities have not ruled out further arrests in the investigation. A court in Rotterdam ordered that the suspect be held for a further 90 days. Stan Duijf, the Dutch police official responsible for cybercrime, stated that arresting suspects is a key intervention in the fight against this type of crime, noting the group’s extensive victim list both domestically and internationally.
