Investigators Probe Ransom Negotiators' Alleged Ties to ShinyHunters Extortion Group

U.S. federal investigators pursuing the ShinyHunters hacking group have identified executives at two ransomware negotiation firms who allegedly kept unusually close relations with the extortion gang, according to Krebs on Security. Sources close to the investigation say one US-based executive helped ShinyHunters operate a website used to pressure victims into paying a ransom.

ShinyHunters has claimed dozens of major data breaches since 2019. The FBI says the group has extorted more than $70 million from victims so far this year. The investigation intensified after the group hacked the FBI recruitment website fbijobs.gov in late September and threatened to publish stolen files. These reportedly included medical and psychological records, Social Security numbers and home addresses. Reuters reported on October 3 that the group's current leader, known as Rey, had been detained in Jordan and was cooperating with the FBI.

The trail to the negotiators reportedly began when Dutch police arrested suspected member Pepijn van der Stap on September 15, 2026. A source says he was logged into Signal at the time, which let authorities read recent messages with frequent contacts, including ransomware negotiators in Canada and the United States. This is only the opening of the story, and the allegations are based on unnamed sources.