"We know how to find you," Brett Leatherman, the FBI’s assistant director for the Cyber Division, told members of the ShinyHunters gang in a videotaped message this week — and urged the remaining members to turn themselves in while "the choice is still yours."
Brett Leatherman’s public warning to ShinyHunters
Leatherman delivered the message after the Dutch National Police arrested a 24‑year‑old whom the FBI described as "one of the alleged leaders of ShinyHunters." In the video, he said investigators were confident the group had seen or heard things "the public has not," and warned that arrests and seized infrastructure change who is willing to talk and what investigators can learn. "The longer you stay in this, the more we learn about you," he said, advising members to "reach out first." The FBI did not immediately answer questions from The Register about whether it had seized any of the group's infrastructure or whether any members had taken Leatherman up on his offer.
Dutch National Police arrest and laptop evidence
Dutch authorities moved to detain a 24‑year‑old suspect this week and, according to police, uncovered "a large amount of information" on the man's laptop. That material reportedly included "details about two murders that were to be committed abroad," with "indications that the suspect gave the order for this," the Dutch police said. The Register reported that, according to FBI Director Kash Patel, the FBI assisted Dutch investigators in making the arrest.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSeized devices, public messaging, and the prospect of more arrests
After the arrest, the FBI said in a public message — described in The Register as a "xeet" — that law enforcement had seized electronic devices and was investigating additional leads. The bureau added: "More arrests possible." Those statements were made alongside the bureau's public call for other alleged members to surrender or contact investigators first.
The FBIJobs.gov intrusion and ShinyHunters' stated motives
Early last week ShinyHunters breached the FBIJobs.gov portal and claimed to have stolen sensitive personal details about current, former, and prospective FBI employees. A ShinyHunters spokesperson told The Register the intrusion was "NOT financially motivated" and said the group wanted "the FBI to correct or retract their statements they made, which included substantial false allegations." In a later exclusive interview the spokesperson framed the operation as reputation management: the hack would preserve ShinyHunters' standing and keep its "business" afloat. "It’s a game and it’s the world we live in," the spokesperson added. "We are just protecting our business as any other business would do. It’s about who does their job better."
How the FBI and Dutch police, ShinyHunters members, and affected FBI personnel are responding
- The FBI and Dutch National Police: Public statements indicate coordinated investigative activity and evidence seizure; the bureau acknowledged assistance to Dutch investigators and signaled that "more arrests [are] possible."
- ShinyHunters members: Leatherman's message explicitly invited remaining members to contact authorities "while the choice is still yours," and the group's public spokesperson has defended the operation as reputation-driven rather than financially motivated.
- Current, former, and prospective FBI employees: Their sensitive personal details were the subject of the group's claims, and the disclosure has prompted both public messaging from investigators and statements from the group disputing official characterizations.
The fast sequence of events — a high‑profile breach of a federal jobs portal, a foreign arrest that yielded laptop material about alleged planned killings, and a public challenge from the FBI to remaining members — leaves several concrete threads in motion. Law enforcement has signaled seized devices and the possibility of additional arrests; ShinyHunters has signaled defiance while insisting the action was not for profit. What remains unanswered in the public record is whether any infrastructure seizures have already revealed further identities, and whether any members will take Leatherman's suggestion to "reach out first" before investigators close more of the circle.
Source: The Register — "FBI to ShinyHunters: 'We know how to find you'"
