Dutch National Police arrest member of group that claimed to have hacked FBI

The FBI and Dutch National Police said Tuesday they had arrested a suspected member of the notorious cyber group ShinyHunters, the group that claimed responsibility for last week's defacing of the FBI's jobs website and bragged that it had stolen data about FBI personnel and job applicants.

The Dutch National Police said Tuesday that the suspect is a 24-year-old from Amsterdam and was arrested on Sept. 15 on suspicion of being a member of ShinyHunters. That means he was already in custody days before ShinyHunters announced it had hacked the FBI jobs website, which was first reported on Sept. 22 by 404 Media.

He is also suspected of attempting incitement to commit two murders, Dutch authorities said. 

Dutch police did not identify the suspect by name, but sources familiar with the case confirmed to CBS News that the man is Pepijn van der Stap.

Brian Krebs, a prominent cybersecurity reporter, earlier confirmed that the suspect is van der Stap and added that he was previously convicted in 2023 in connection with a string of data thefts and extortions. In the prior case, van der Stap admitted he secretly used the hacker handle "Umbreon" to extort victims, Krebs reported.

Van der Stap will be facing criminal charges for the alleged attempting incitement to commit two murders and alleged hacking as separate cases in the same court. While he is being detained, he is only permitted to speak with his lawyer while police continue the investigation, one of the sources added.

The Dutch authorities said they had seized several data carriers and further arrests in the case could not be ruled out. They said a large amount of information was discovered on his laptop, including the details about the two murders that were supposed to be committed abroad. The suspect is being held in isolation, and he is expected to be held in pretrial detention for at least 90 days, Dutch authorities said. 

FBI Cyber Division Assistant Director Brett Leatherman said Tuesday that Dutch authorities had the "full support" of the FBI. 

"Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments," Leatherman said. "They often target third-party vendors and cloud-based platforms, stealing sensitive data and extorting victims with threats to publishing." 

In a post on X, FBI Director Kash Patel did not identify the individual who was arrested, but referred to the person as "one of the alleged leaders" of the organization. "As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest," Patel wrote.

The FBI said in a statement that it is "working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted — including multiple Bureau wide communications within 24 hours of public reporting." The FBI also said that the investigation is ongoing.

Last week, ShinyHunters claimed in communications posted on the dark web and exchanges with multiple media outlets that it stole two to three terabytes of data related to FBI and Justice Department workers. The hackers said they used a new vulnerability in Oracle PeopleSoft, a human resources management program. 

In one such post last Tuesday, ShinyHunters addressed Patel and Leatherman, saying: "We have compromised the FBI."

The cybercriminals said they possessed sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs. It listed criminal justice, human resources and Medlink systems among the services that were affected.

On Monday, The New York Times reported that FBI employees had received an internal email that declared the hack to be a cybersecurity incident and acknowledged that personal information of some employees had been stolen.

That internal security notice sent to employees at the FBI recently confirmed that hackers did obtain employee information, a sample of which was shared with some select members of the media, according to a source with knowledge about the internal communication.

The FBI told employees that multiple divisions are now investigating the breach and coordinating support for those who were impacted.

Employees were also advised to take heightened security precautions and that they should report suspicious contacts, harassment or any threats they may receive.

The internal communication also told employees that the bureau is evaluating additional identity protection and related support services for affected employees and their families.

An FBI spokesperson declined to comment on the notice's contents but said the bureau has been in constant communication with its employees since the incident took place, and added that the FBI has been providing notifications and updates as more information became available.