ShinyHunters leadership in custody: arrests in the Netherlands and Jordan within two weeks
Two men described by investigators as leading figures in the ShinyHunters data-theft and extortion group have been taken into custody in separate countries within roughly two weeks. A 24-year-old Dutch national was arrested in the Netherlands on 15 September, and an 18-year-old suspected co-leader was detained in Jordan in late September. Taken together, the cases amount to the most visible enforcement pressure in some time on the breach-and-extort scene that grew in the orbit of BreachForums.
An arrest in the Netherlands
Dutch police say their national High-Tech Crime Unit arrested the 24-year-old on 15 September 2026 as part of an investigation into ShinyHunters. As Reuters reported when the news was announced by the Dutch force on 28 September, the man has been ordered detained for 90 days while the investigation continues, and has appeared before a court in Rotterdam. KrebsOnSecurity identifies the suspect as Pepijn van der Stap, a detail the initial wire reports did not carry. Before the arrest, van der Stap had publicly presented himself as a reformed hacker. That self-description is now part of the story in its own right. He has not been convicted of any offence, and every allegation against him remains exactly that until a court rules. The FBI followed with its own public announcement on 29 September, a day after the Dutch statement. In it, Brett Leatherman, the bureau's assistant director of cyber, described the arrested man as an alleged leader of ShinyHunters. That framing matters: it presents the case not as the pursuit of one participant among many, but as an attempt to remove people alleged to direct the group's operations. The Dutch case also carries an allegation that sets it apart from routine cybercrime proceedings. According to the BBC, the suspect is additionally suspected of attempted incitement to commit two murders, allegedly connected to a plotted attack on the FBI. Dutch investigators have not publicly detailed the evidence behind that suspicion, but its inclusion in the case underlines how seriously authorities are treating the investigation.A second detention in Jordan
Reuters reported on 4 October that a second person alleged to co-lead ShinyHunters, an 18-year-old known online as Rey, had been detained in Jordan in late September. KrebsOnSecurity examined the case in more depth on 7 October and identifies him as Saif al-Din Khader, based in Amman. Public reporting on the circumstances of the detention remains limited, and it is not yet clear what process will follow. The group's own conduct in the weeks before the detentions is part of the backdrop. In September, ShinyHunters claimed responsibility for defacing the FBI's website, an unusual gesture aimed at the agency now pursuing its alleged leadership. Multiple outlets have since reported that the 18-year-old detainee is cooperating with the FBI. That claim deserves caution: it has not been verified, and neither the FBI nor the Jordanian authorities have confirmed it.A Boeing spin-off in the background
The commercial context around the group is documented as well. KrebsOnSecurity reported in October that, prior to the arrests, ShinyHunters had extorted a company recently spun off from Boeing. The detail fits the group's established pattern: large-scale theft of corporate data, followed by payment demands backed by the threat of publication on leak sites and breach forums. It is that model, rather than any single intrusion, that investigators in both countries appear to be targeting.What it means for the breach forum scene
For the BreachForums-adjacent ecosystem, the arrests land on a scene that has already shown it can adapt. BreachForums itself has been disrupted before, and successor platforms have absorbed its user base each time; we looked at how Darkforums filled the BreachForums vacuum. What distinguishes the current moves is the target. These are not seizures of domains or infrastructure, which a motivated group can replace in days, but custodies of the people alleged to run one of the scene's most productive extortion brands.- Netherlands: Pepijn van der Stap, 24, arrested on 15 September 2026, ordered detained for 90 days, appeared before a court in Rotterdam; also suspected of attempted incitement to commit two murders.
- Jordan: Saif al-Din Khader, 18, known online as Rey and based in Amman, reportedly detained in late September; reported by multiple outlets to be cooperating with the FBI, unverified.