A conflict with a well-known hacker group, an attack on the FBI’s infrastructure, a public challenge to U.S. law enforcement - and then arrests and the disappearance of their own infrastructure. The story of ShinyHunters clearly illustrates what happens to a criminal group when it starts to believe too strongly in its own PR. The hunter becomes the prey.

The ShinyHunters cybercriminal group emerged around 2019 and initially became known primarily for stealing corporate databases, selling them on underground marketplaces, and subsequently engaging in extortion. The U.S. Department of Justice has linked the group to data theft from more than 60 companies between 2020 and 2021 alone. And ShinyHunters quickly realized the value of their brand.

Stolen databases appeared on underground forums. The operators communicated with journalists. The hackers sometimes even demonstrated the evidence of the breaches themselves. In other words, what was taking shape was not just a group of hackers, but a recognizable criminal brand. This was no longer just teenage forum trolling. It was a serious criminal enterprise. Large volumes of data. Major companies. Demanding demands. And a very serious reputation.

One of the most notorious episodes in the group’s early history was the arrest of French national Sébastien Raoul, who used the alias Sezyo Kaizen. U.S. authorities linked him to ShinyHunters and numerous attacks on corporate systems. In January 2024, he was sentenced in the U.S. to three years in prison and ordered to pay more than $5 million in restitution.

But the real global impact came later. In 2024, ShinyHunters was linked to a series of high-profile incidents involving Snowflake customer data, including Ticketmaster and Santander. In the Ticketmaster case, the attackers claimed to have accessed approximately 560 million records and put the data up for sale. In the Santander case, the breach involved the data of millions of customers and employees. It was then that ShinyHunters finally ceased to appear as just another group from an underground forum.

There’s no point in listing all of the group’s “exploits,” but the U.S. FBI claims that recently, the group and its accomplices have compromised more than 140 organizations and received at least $70 million in ransom payments. They had reached a point where they felt they could do anything. They began to feel invulnerable. And that became their “Achilles’ heel.”

In September, ShinyHunters announced that it had gained control of the leak site belonging to the notorious Cl0p ransomware group. It was practically the perfect trolling move from a criminal PR standpoint: a tool of extortion had been turned into a tool to extort the extortionists themselves. ShinyHunters didn’t just hack a competitor. They turned it into a spectacle. And then they demanded a ransom from Cl0p.

According to Recorded Future News, the demand was in the eight-figure range, and ShinyHunters’ messages even included a point-blank reference to the group’s own wealth - implying that the demanded amount was only 2.333% of their “net worth.” And that’s a very telling detail. Because when a criminal group starts publicly boasting about how rich it is, it stops being just trolling. It becomes showing off.

But that wasn’t enough for ShinyHunters. On September 22, the main attraction appeared at this “vanity fair.” The group hacked FBIJobs.gov - the Federal Bureau of Investigation’s job portal for applicants. They stole data from 4,000 people and posted their logo on the agency’s website. 

Interestingly, ShinyHunters did not explain the attack as a typical case of financial extortion. The group claimed it was acting in response to the FBI’s publications about it and wanted to force the bureau to change or remove its descriptions of ShinyHunters’ activities. In other words, the criminal group decided to publicly challenge law enforcement on its own turf. 

But at some point, publicity ceases to be a form of protection and becomes a source of intelligence for the enemy. You yourself tell journalists what you’ve done. You yourself publish the evidence. You yourself name your targets. You yourself announce the timelines. You yourself create conflict with your competitors. You make demands yourself. And then you’re surprised when law enforcement begins to piece together the puzzle. That’s exactly what happened with ShinyHunters.

On September 15, 2026, Dutch police arrested a 24-year-old Amsterdam resident on suspicion of involvement with ShinyHunters. Dutch authorities reported the seizure of digital media and did not rule out further arrests. U.S. authorities identified the detainee as one of the group’s alleged leaders. ShinyHunters itself denied any connection to him. But the fact remains that, at the time of the attack on the FBI, one of the alleged participants was already in custody.

Then, on September 29–30, an event occurred that seemed almost symbolic. ShinyHunters demanded that the FBI amend or retract certain statements about the group. The FBI did not comply. The deadline set by ShinyHunters expired. Soon after, the group’s website went offline. The group itself attributed the site’s disappearance to interference and sabotage. But regardless of what the actual technical cause was, the situation was highly telling: the group issued an ultimatum to the FBI - and a few days later, it lost one of the main tools of its public presence.

In early October, the sun stopped shining for the ShinyHunters once again. Reports emerged that Saif al-Din Hadera, who is linked to the ShinyHunters and goes by the alias Rey, had been detained in Jordan. According to sources, he is currently cooperating with U.S. investigators and providing access to his devices and correspondence. 

The FBI has not confirmed specific details of the arrest but stated that it has already worked with partners to arrest suspects and is continuing its investigation. If the reports of cooperation are true, this is potentially much more serious than yet another website shutdown. Because infrastructure can be restored. But a person who knows the group’s internal structure, its contacts, and communications - that’s a whole different story. Now the only question is when he’ll reveal everything he knows and how the FBI will use that information. 

ShinyHunters ruined their own reputation. They broke the rules time and again and went too far. They attacked competitors and disrupted the ecosystem in which all cybercriminals - including themselves - operate. They hacked into intelligence agencies. And they constantly drew attention to themselves. Every new, high-profile transgression increased the brand’s notoriety. But at the same time, it increased the number of people interested in destroying that brand.

And if the current string of arrests and investigations continues, the ShinyHunters story may well make its way into textbooks - not only as the story of one of the most prominent cybercrime brands of recent years, but also as a prime example of why excessive publicity, self-aggrandizement, and constant escalation ultimately become a vulnerability. Because in this game, there’s a rule that applies no matter how big your nickname seems: the longer you break the rules and the louder you shout about it to the whole world, the more resources people are willing to spend to find and destroy you.