FBI Warns ShinyHunters Cybercrime Gang To Surrender Before Agents Kick In Their Doors
The ongoing virtual cat-and-mouse game between the FBI and one of the world's most aggressive cybercrime collectives, ShinyHunters, might be coming to an end, thanks to the arrests of key members and seizure of the groups digital infrastructure by the Dutch National Police.
The arrest comes after ShinyHunters executed an audacious intrusion against the FBI's servers and portals recently. It is believed that the group leveraged an unpatched zero-day vulnerability in Oracle's PeopleSoft software to breach bureau recruitment portals, human resources infrastructure, and criminal justice databases. To maximize public embarrassment, the hackers defaced the FBI's primary recruitment portal, replacing it with a message stating the site had been seized, while distributing a verified sample dataset containing sensitive personal identifiable information for roughly 5,000 personnel. The group claimed to have exfiltrated up to three terabytes of records covering thousands of current and former agents.
ShinyHunters stated that the hack was a non-financial retaliation against a previous federal law enforcement advisory, which they dismissed as deliberate disinformation to harm their reputation. The collective issued a strict ultimatum demanding a formal retraction.
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
— FBI Cyber Division (@FBICyberDiv) September 29, 2026
The Dutch High-Tech Crime Unit arrested the suspect under Dutch law.… pic.twitter.com/EdfWJpVx2n
Leatherman made it clear that federal investigators are closing in on their network. Stressing how the recent arrest and seized digital infrastructure have provided law enforcement with crucial internal intelligence, he warned the syndicate that their time spent operating in the shadows is running out. Pointing out that flipped suspects and seized servers have a way of revealing who remains active in a criminal network, he urged the hackers to surrender voluntarily before investigators track down every remaining member.
"The longer you stay in this, the more we learn about you," Leatherman warned. "You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."
Thus far, ShinyHunters has breached more than 140 organizations, extorted roughly $70 million, and stolen hundreds of millions of sensitive customer and employee records globally.
