Photo via NBC News

FBI sends warning to cybercrime group that hacked it after Dutch arrest of ‘leader’

Read the original at NBC News ↗
Cite

O'Donnell, K. (2026, September 29). FBI sends warning to cybercrime group that hacked it after Dutch arrest of ‘leader’. NBC News. https://www.nbcnews.com/tech/security/fbi-warns-shinyhunters-crime-group-hacked-agent-data-arrest-rcna600480

Dated when The Aporia collected the article, usually within hours of publication. Check the original for its exact date and byline.

NBC News · collected 2026-09-29 · by Kelly O'Donnell

Quick Summary

Dutch authorities arrested a 24-year-old Amsterdam man suspected of being a leader in ShinyHunters, an international cybercrime group that recently claimed responsibility for hacking the FBI’s jobs portal and stealing sensitive personal information from agents. Assistant Director Brett Leatherman of the FBI’s Cyber Division used this arrest to warn remaining members of ShinyHunters to turn themselves in, suggesting that anonymity does not protect them. The timing of the hack—after the suspect's detention on September 15—raises questions about internal coordination within the group. The FBI did not disclose how many individuals were affected by the breach but confirmed it involves Social Security numbers and other personal data.
Written by AI on 2026-09-29, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

On September 15, Dutch law enforcement arrested a 24-year-old man, identified as the leader of ShinyHunters, an international cybercrime group. A week before this arrest, ShinyHunters claimed to have hacked an FBI website and stolen sensitive personal information on FBI agents. Although the FBI hasn't confirmed if the arrest directly led to the hacking incident, they used it as a warning against other members of the ShinyHunters network.

Assistant Director Brett Leatherman of the FBI Cyber Division published a video statement on the official FBI website, urging remaining ShinyHunters members to surrender. He emphasized that anonymity and protection from friends won't shield them from arrest, citing recent seizures of infrastructure as proof that enforcement is serious. Leatherman encouraged hackers to contact law enforcement proactively before being caught.

The incident highlights the increasing collaboration between international law enforcement agencies in tackling cybercrime, emphasizing the vulnerability even of high-profile targets like the FBI itself.

Written for “FBI Cyber Warning After Arrest” on 2026-11-01, grounded in this article and the 0 other(s) covering the same event.

Story

📰 FBI Cyber Warning After Arrest
Crime & Law · 1 article(s) covering the same event.

Compared with similar articles

This article reads unscored and hedges 30% of its claims. Each row says how that neighbour differs.
The Straits Times
Hedges 4 of 9 claims Outlet record 66/100
“The articles describe different arrests of ShinyHunters members in separate countries, indicating distinct events.”
Times of India
Hedges 2 of 8 claims Outlet record 59/100
“The articles describe different arrests of ShinyHunters members by Dutch and Jordanian authorities, not the same incident.”
404 Media
Hedges 5 of 45 claims Outlet record 95/100
“The articles describe different aspects of related events: one discusses the hackers' decision not to publish data, while the other reports on an arrest by Dutch authorities and a warning from the FBI.”
BBC News
Hedges 10 of 41 claims Outlet record 68/100
“While both articles discuss the FBI hack incident, Article A focuses on the immediate aftermath and reactions of FBI agents, while Article B reports on a subsequent action taken by the FBI in response to the hack, including an arrest made days later.”
CBC News
Hedges 7 of 34 claims Outlet record 74/100
“The articles describe different stages of the incident: one discusses the hacking itself and the group's activities, while the other covers a subsequent arrest made by Dutch authorities and the FBI's response.”
CBC News
Hedges 4 of 30 claims Outlet record 74/100
“Article A discusses the ShinyHunters' statement about not leaking stolen FBI data, while Article B reports on Dutch authorities arresting a suspected leader of ShinyHunters and the FBI's response to warn other members. These are related but distinct events.”
The Straits Times
Hedges 5 of 19 claims Outlet record 66/100
“The articles describe different arrests of ShinyHunters members in separate locations (Netherlands and Jordan) on different dates.”
Fox News
Hedges 36 of 141 claims Outlet record 69/100
“Article A describes the arrest of a leader of ShinyHunters by Dutch authorities, while Article B focuses on ShinyHunters' claim to have hacked FBIJobs.gov and stolen sensitive data. Although both articles mention ShinyHunters and their activities involving the FBI, they describe different specific incidents occurring at different times.”
Fox News
Hedges 6 of 18 claims Outlet record 69/100
“While both articles refer to the same hacking incident involving the FBI's jobs portal, Article A describes the initial breach announcement, while Article B covers a subsequent development with an arrest and warning issued by the FBI.”
The Straits Times
Hedges 0 of 12 claims Outlet record 66/100
“The first article reports on the arrest of a suspect in connection with ShinyHunters, while the second article mentions this arrest but also discusses a separate incident involving the FBI's website hack.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
30
sentences that state something as happening or true
Uncertain
30%
9 of 30 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
60/100
NBC News's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
1
Crime & Law
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-09-29 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

NBC News · 1958 article(s) · 1 correction(s) detected
Running correction rate · 1 correction(s)

Who wrote this

Kelly O'Donnell
3 article(s) here · 1 carrying a prediction
🔮 The threat assessment center was developed to study how other kinds of attacks could be prevented.
🔮 The designated pooler distributes editorial content and video feeds widely to the other networks and pool subscribers, which can include outlets that may not have the resources to shoot and distribute coverage themselves.
2026-10-12 · assertive framing · What’s the White House press pool?
🔮 “Other groups believed anonymity or their friends would protect them and they were wrong.
Also by Kelly O'Donnell
Nothing else under this byline is closely related to this article, so these are simply their most recent.

Topics

Cyber Division Dutch FBI NBC News ShinyHunters

Subjects

FBI ORG · 16× ShinyHunters ORG · 12× Dutch NORP · 4× Leatherman ORG · 3× NBC News ORG · 3× Amsterdam GPE · 1× Brett Leatherman PERSON · 1× Cyber Division ORG · 1× Dutch National Police ORG · 1× Justice Department ORG · 1×

Narrative

Dutch authorities and the FBI said Tuesday that Dutch law enforcement had arrested a leader of ShinyHunters, the international cybercrime group that last week claimed to have hacked an FBI website and stolen sensitive personal information on agents.
framing: mixed · carried by 1 article(s) · first seen 2026-09-29
🔮 “Other groups believed anonymity or their friends would protect them and they were wrong.

Claims (30 extracted, 9 hedged)

Dutch authorities and the FBI said Tuesday that Dutch law enforcement had arrested a leader of ShinyHunters, the international cybercrime group that last week claimed to have hacked an FBI website and stolen sensitive personal information on agents. asserted
that → say → agents
The bureau is not explicitly tying the Dutch man’s arrest to the FBI hack, which seemingly occurred after the man was detained, but is using it to warn other members of the ShinyHunters criminal ring. asserted
man → tie → ring
In a video statement published to the FBI website, Cyber Division Assistant Director Brett Leatherman addressed the hackers directly and urged them to confess to law enforcement. asserted
Leatherman → publish → enforcement
“To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague,” Leatherman said. asserted
Leatherman → remain → colleague
“Other groups believed anonymity or their friends would protect them and they were wrong. asserted
they → believe → them
Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” he said. asserted
he → have → us
“I suggest you reach out first while the choice is still yours.” asserted
choice → suggest → ?
Leatherman did not directly address the FBI hack in his message to ShinyHunters. asserted
Leatherman → address → ShinyHunters
Earlier on Tuesday, Dutch National Police announced that on Sept. 15 it had arrested a 24-year-old Amsterdam man suspected of being a ShinyHunters hacker. asserted
it → announce → man
They said he is separately being investigated for allegedly ordering two murders abroad. uncertain
he → say → murders
It routinely hacks companies to steal sensitive data and then threatens to leak it onto the dark web unless they’re paid a fee. asserted
they → hack → fee
Last week, ShinyHunters announced on its website it had hacked the FBI’s jobs portal site and stolen significant personal information on agents. asserted
it → announce → agents
The group demanded that the FBI retract a public service announcement about the group issued in May. uncertain
FBI → demand → May
It gave a deadline of Sept. 29 to do so, though it did not explicitly say it would publish the data it had stolen. asserted
it → give → data
ShinyHunters breached the FBI on Sept.21, placing the hack after the Dutch man’s arrest. asserted
ShinyHunters → breach → arrest
The group did not respond when asked about the arrest and Leatherman’s message. asserted
group → respond → arrest
While the full extent of what ShinyHunters stole from the FBI is unclear, a ShinyHunters spokesperson sent NBC News a sample document that included sensitive personal information about a former agent, who confirmed it was authentic. uncertain
it → steal → agent
According to a Justice Department notification to lawmakers obtained by NBC News, the FBI designated the matter a cybersecurity incident on Sept. 22. uncertain
FBI → accord → Sept.
It said the affected system holds sensitive personal information, including Social Security numbers, dates of birth, phone numbers, addresses and emergency contact information, and that investigators are still working to determine how many people may have been affected. uncertain
people → say → birth
ShinyHunters also claimed to have used its access to the FBI jobs portal to pivot and steal a cache of other information from multiple other agency programs, but did not provide evidence of those claims. uncertain
ShinyHunters → claim → claims
The FBI sent a message to employees on Friday saying they were working on the premise that personally identifiable information of employees may have been obtained, according to a person familiar with the communication, and to be vigilant and report any unsolicited contacts. uncertain
information → send → contacts
The person said that some FBI employees were frustrated that they heard about the data breach from the media as well as what they saw as a slow response from the bureau. asserted
they → say → bureau
“The FBI is working around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted — including multiple Bureau wide communications within 24 hours of public reporting. uncertain
who → work → reporting
The FBI treats the security of its information and the safety of its workforce as top priorities, and our investigation is ongoing,” an agency spokesperson said in a statement. asserted
spokesperson → treat → statement
On Monday afternoon, before the FBI’s announcement, the ShinyHunters spokesperson told NBC News that it now was committed not to publish any data it had stolen from the agency. asserted
it → tell → agency
The spokesperson added a lengthy statement that indicated it was backing down from its demand the PSA be retracted. asserted
PSA → add → demand
“This was all a marketing campaign to protect our business and actively combat disinformation,” the statement said. asserted
statement → protect → disinformation
It may have been worded like a threat but ultimately the public has drove this story out of context and made their own wild assumptions and speculations uncertain
public → word → assumptions
,” it said. asserted
it → say → ?
“We stand corrected.” asserted
We → stand → ?
💬Give feedback
🕘History 🎫Support