A Dutch former hacker who had reformed and worked as a cybersecurity professional has been arrested on suspicion of belonging to the ShinyHunters gang believed to have stolen data on nearly all FBI employees in a recent breach.

Police did not disclose the name of the man arrested, but Benjamin Korper, chief executive of Amsterdam-based Neo Security, confirmed to journalists that it was Pepijn van der Stap, 24, whom he had hired as offensive security lead.

Korper told Reuters Dutch forensic investigators visited his office on 15 September.

Murder threat

Van der Stap was arrested the same night in a raid by Dutch National Police, meaning he was already in custody at the time of the FBI data breach, which first came to light on 22 September.

ShinyHunters said van der Stap was not part of the group.

Dutch authorities said they had seized a large amount of information from van der Stap’s devices, including information on his laptop about two murders that van der Stap is suspected of attempting to incite, and which were to have taken place abroad.

In a video address posted to social media on Tuesday, FBI assistant director Brett Leatherman said van der Stap’s arrest should serve as a warning that cyber-criminals are not “anonymous”.

‘We know how to find you’

“You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours,” he said.

The FBI said it is “working around the clock” to investigate the breach, which has been compared in scope to the disastrous 2015 hack of the US Office of Personnel Management, blamed at the time on actors backed by the Chinese government.

ShinyHunters initially threatened to release the data on FBI employees, which is believed to include assignments and medical data, but later said did not intend to do so, saying the hack had been a “marketing campaign”.