OMITTED

What the news leaves out.

← Omitted front page

Dutch Police Arrest Alleged ShinyHunters Hacking Leader

5 sources · updated 2026-09-30
Left 40% Center 40% Right 20%
2 left · 2 center · 1 right

What happened

On September 15, Dutch National Police arrested a 24-year-old Amsterdam man on suspicion of participating in the ShinyHunters cybercrime group and of attempting to incite two murders abroad, seizing electronic devices and saying he was expected to remain in pre-trial detention for at least 90 days, with further arrests not ruled out. Krebs on Security and Reuters identified the suspect as Pepijn van der Stap, who was convicted in 2023 of data theft and extortion and later worked as an offensive-security lead at Amsterdam firm Neo Security; a ShinyHunters representative said he had "no association" with the group. After the arrest, ShinyHunters claimed around September 21 that it had breached the FBI jobs portal and stolen personnel data, and the FBI designated the matter a cybersecurity incident on September 22. On Tuesday, FBI Cyber Division Assistant Director Brett Leatherman released a video telling remaining ShinyHunters members to contact authorities first, and FBI Director Kash Patel called the detainee one of the group's alleged leaders.
Sourcing check · Fully on the record · 5 articles

5 of 5 articles cite a named source for the story. It was on the record from the first report.

What these terms mean and how they're counted
On the record · names a source 5 of 5
On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Kash Patel, Brett Leatherman, Dutch National Police, FBI Cyber Division, FBI and Dutch police
Primary evidence · cites a document or data 1 of 5
Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: press release
Credits another outlet 0 of 5
The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
Unnamed sources 0 of 5
The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
How it developed
When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Sep 29, 14:23 UTC by Fox News, naming its source. First document 7 hours later, from The Verge (press release).
Not counted 0
Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out

Unpacked

Right-leaning coverage presents the Dutch arrest as payback for the FBI breach, omitting that the suspect was already in custody when that hack was claimed. Fox News headlines that the FBI "strikes back" and never notes that the jobs-portal intrusion came after the detention. Left-leaning coverage puts the sequence on the table: NBC News reports the bureau is not explicitly tying the arrest to a hack that happened after the man was held. Right-leaning coverage spends its middle on the suspect's employer saying a second chance was not repaid. Left-leaning coverage never interviews that boss and stays instead with the FBI's warning video and the group's own claims about the breach. If the alleged leader was already locked up, who breached the FBI jobs site?
Bottom line

Fox News billed the arrest as the FBI striking back at ShinyHunters. NBC News told readers the suspect had been in custody since September 15, before the group even claimed the FBI hack.

The receipts — 2 facts one side's coverage lacks
  • A Justice Department notification to lawmakers said the affected FBI system holds Social Security numbers and other sensitive personal information official statementin NBC News · absent from right-leaning coverage
  • The arrest raid at Neo Security involved flash-bang grenades individual casein Fox News · absent from left-leaning coverage
The Left View
Left-leaning outlets framed the announcement as the FBI warning a group that had just claimed to hack it, stressing that the bureau was "not explicitly tying" the Dutch arrest to the jobs-portal breach, which sources placed after the man was already detained. NBC News reported that a sample document ShinyHunters provided about a former agent was authentic, that a Justice Department notice said the affected system held Social Security numbers and other personal data, and that some employees were frustrated they heard of the incident from the media and saw the bureau's response as slow. Coverage also noted that ShinyHunters later said it would not publish any stolen FBI data, calling the episode a "marketing campaign" to combat what it termed disinformation and adding, "We stand corrected."
The Right View
Right-leaning coverage presented the case as the FBI striking back, highlighting a joint operation with Dutch police against a global syndicate linked to high-profile U.S. and international attacks. Fox News led with Patel's announcement and Leatherman's message that "we know how to find you," and described a dramatic raid at Neo Security that used flash-bang grenades. It emphasized the suspect's earlier convictions, his public claim that he had turned to building and protecting rather than breaking systems, and his employer's statement that he had believed in a second chance but "was not thanked for it," while recording ShinyHunters' claim that Dutch police were incompetent.
Our Take (balanced)
The left's strongest argument is the timeline: because the suspect was already in custody before ShinyHunters claimed the FBI breach, treating the arrest as a strike against the group that just hit the bureau overstates what authorities have shown, a gap NBC News underscored by noting the FBI did not explicitly connect the two. The right's strongest argument is that U.S. and Dutch officials nonetheless identified the detainee as an alleged ShinyHunters leader, seized devices they said contained evidence including planned murders abroad, and used the arrest to pressure remaining members—an operational claim Fox News treated as a concrete blow to a prolific extortion network. The central unresolved tension is whether the arrest actually disrupted ShinyHunters, given the group's denial of any link and the post-detention FBI breach claim, or mainly gave the bureau a public warning after its own systems were compromised.

5 sources

More stories

The week's bottom lines, in your inbox

One email a week: the five stories that mattered and what they actually mean. Free.