Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-profile data thefts and corporate extortions orchestrated by the prolific hacker collective known as ShinyHunters. The detention has sent shockwaves through the underground cybercrime ecosystem, triggering an immediate and dramatic escalation from remaining members of the group. In the days following the suspect’s arrest, the syndicate launched aggressive retaliatory attacks, including stealing highly sensitive personnel data from the Federal Bureau of Investigation (FBI) and extorting the notorious Russian ransomware operation Cl0p.
According to three independent sources familiar with the ongoing international investigation, the Dutch man taken into custody by law enforcement is Pepijn van der Stap, a convicted cybercriminal originally from the Dutch municipalities of Almere and Lelystad. Van der Stap previously caught the attention of international law enforcement and prosecutors in 2023 following a string of sophisticated data thefts and extortion schemes. Dutch prosecutors at the time estimated that his illicit operations generated between €1.5 million and €2.7 million in illegal proceeds.
During his criminal trial in late 2023, van der Stap candidly admitted to living a double life akin to a digital Dr. Jekyll and Mr. Hyde. By night, he secretly utilized the hacker handle "Umbreon"—named after the fictional Pokémon character—to extort corporate victims and dump stolen databases on prominent English-language cybercrime forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a respectable professional facade, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization dedicated to identifying and mitigating software vulnerabilities.
Van der Stap ultimately confessed to his extensive data theft and extortion activities during legal proceedings and was sentenced to four years in prison, with one year suspended. In a peculiar turn during his trial, van der Stap elected to remain in custody rather than returning home, asserting that he could not find adequate psychiatric care outside of prison for his ongoing mental health struggles, which he attributed to post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a completely reformed individual who was actively trying to rebuild his life and make positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that has since declined to respond to media requests for comment regarding the arrest.
During the conversation, van der Stap noted that he was still navigating complex civil lawsuits and court-mandated restitution tied to his past cybercrimes, emphasizing that he was doing everything in his power to make amends. However, shortly after that interview concluded, van der Stap abruptly ceased all communication. Efforts by professional colleagues and personal acquaintances to reach him repeatedly failed over a two-week period.
According to two sources with direct knowledge of the ongoing investigation, Dutch law enforcement officers arrested van der Stap on or around September 16. He has since been held in secure custody for intensive questioning. One source reported that a colleague personally witnessed Dutch authorities removing boxes of electronic equipment and other items from van der Stap’s residence during the raid.
Dutch law enforcement agencies have spent months pursuing members of the ShinyHunters network. Earlier in September, authorities launched a public appeal seeking assistance in identifying the native Dutch-speaking voice of a hacker recorded during a telephone call in February 2026. In that audio recording, the suspect successfully social-engineered his way into Odido, the largest mobile telecommunications provider in the Netherlands. Posing as an internal representative, the hacker tricked an Odido employee into authenticating their credentials on a spoofed phishing website. The attackers then leveraged that unauthorized access to steal personal data belonging to more than 6.2 million Dutch citizens.
Responding to local media reports in the Netherlands, representatives of ShinyHunters publicly confirmed that the individual heard in the police audio clip is indeed an active member of their hacker collective.
"Our team member has our full support — emotionally, mentally, and financially," the hackers stated in a message shared with the NL Times. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
It remains unclear whether Dutch investigators have successfully matched the voice from the Odido intrusion to a confirmed real-world identity. The specialized Dutch police unit managing the Odido investigation declined to comment on the ongoing operational status of the case.
At the same time, the collective lashed out aggressively at Dutch law enforcement. "The Dutch police will need all the luck in the world — and everyone’s prayers — if they want to catch him before we carry out another large-scale data theft in the Netherlands," the group’s statement read. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
FBI and Cl0p Hacks
Just days after sources confirmed van der Stap was detained by authorities, ShinyHunters claimed responsibility for an unusually brazen cyberattack targeting the FBI’s official job application portal, apply.fbijobs.gov. According to investigative reporting from 404 Media, the data exfiltrated from the federal portal included Social Security numbers and deeply personal background information concerning more than 5,000 current and prospective FBI officials.
Both 404 Media and Reuters confirmed that the compromised federal data cataloged specific job titles, sensitive assignments, and operational units, including special agents, threat intake examiners, and personnel assigned to major cybercrime divisions and teams investigating foreign state-backed cyber operations. Furthermore, Reuters reviewed documentary evidence provided by the hacking group showing that the leaked files included confidential psychiatric and medical records belonging to FBI personnel. The bureau subsequently issued a brief public statement acknowledging the unauthorized compromise of the job application portal.
According to the attackers, access to the FBI portal and other victim infrastructure was achieved by exploiting a recently patched vulnerability, cataloged as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widely used software-as-a-service platform developed by Oracle that helps major enterprises and government bodies manage human resources, candidate recruitment, employee benefits, and payroll functions. Oracle swiftly rolled out a security patch to address the vulnerability after discovering that ShinyHunters had begun actively weaponizing the flaw as a zero-day exploit in June. Security firm Mandiant concurrently issued web application firewall (WAF) rules to protect organizations that were unable to apply the official vendor patch immediately.
However, security researchers revealed that ShinyHunters managed to circumvent these protective measures. Investigators discovered that the hackers utilized a URL-encoding trick to successfully bypass the WAF mitigation rules deployed by Mandiant. In a joint threat intelligence report released on September 25, security analysts from Mandiant and the Google Threat Intelligence Group confirmed that the collective engaged in a mass-exploitation campaign targeting the PeopleSoft vulnerability across dozens of corporate and institutional networks, impacting higher education, technology, healthcare, agriculture, transportation, and government sectors.
A subtle signature discovered within the FBI breach pointed directly back to the ongoing investigation in the Netherlands. The digital defacement message left behind by ShinyHunters on the compromised FBI jobs portal featured an ASCII art graphic of the Pokémon character Umbreon—the exact hacker alias previously used by van der Stap. Atop the graphic, the hackers inscribed a message reading, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Security analysts noted that the visual layout was identical to a defacement message deployed by ShinyHunters during their 2020 intrusion into the English-language cybercrime forum HackForums.
Multiple sources close to the unfolding investigation suggested that the group’s high-risk attacks against high-profile federal infrastructure and prominent Russian-speaking ransomware syndicates represented a significant tactical pivot. This sudden escalation reportedly followed a leadership shift within ShinyHunters, which sources say was recently taken over by a teenage cybercriminal from Amman, Jordan. Operating under the online moniker "Rey," the young hacker belongs to an umbrella cybercrime faction known as ScatteredLapsussHunters (SLSH), which security experts describe as a coalition merging elements from Scattered Spider, LAPSUS$, and ShinyHunters.
Sources indicated that Rey maintained a bitter personal rivalry with van der Stap over control of the ShinyHunters brand and proprietary data troves. The inclusion of the prominent Umbreon artwork in the FBI portal defacement was allegedly an intentional attempt by Rey to frame the imprisoned Dutch hacker for the federal breach.
Rey was first unmasked by cybersecurity firm KELA in March 2025. Ahead of a subsequent security profile published later that year, researchers contacted Rey’s father to request an interview. Rather than intervening, the father forwarded the message directly to his son, who openly admitted to participating in past ransomware operations while claiming he was trying to distance himself from the SLSH network.
Blaming Umbreon
Immediately after news of the FBI portal compromise broke across mainstream media outlets, Rey’s primary social media account on X (formerly Twitter) began openly taunting both the Cl0p ransomware syndicate and federal investigators. One posted meme crudely depicted the FBI and Cl0p as the twin towers in New York City being struck by aircraft labeled "cl0p drama" and "fbi breach claim," with a giant float-sized depiction of the Pokémon character Umbreon looming in the foreground.
On September 24, security researchers once again contacted Rey’s father to request an interview regarding his son’s rising influence within the ShinyHunters syndicate. Hours after that outreach, Rey deleted his long-standing social media account. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, did not respond to subsequent email inquiries concerning his son’s alleged illicit activities.
The underlying friction between the SLSH faction and core ShinyHunters members stems from a brief operational partnership earlier in the year. According to investigative reporting published by Wired, the groups had initially joined forces to better monetize high-value corporate credentials harvested by TeamPCP, an emerging cybercrime cell specializing in supply chain compromises. Although TeamPCP successfully infiltrated global software supply chains, its members struggled to extract substantial financial payouts from their stolen data. Two alleged leaders of TeamPCP were subsequently arrested in Australia, with one admitting during interrogation that the group earned a mere $20,000 from their operations.
Investigative reports revealed that Mandiant had covertly infiltrated TeamPCP’s infrastructure and was secretly responsible for burning the group’s stolen credentials. Mandiant funneled compromised authentication keys directly to major cloud infrastructure providers like Amazon and Microsoft, prompting immediate invalidation of the credentials. As the operation collapsed, the allied hacker factions began pointing fingers and blaming one another for rendering the stolen assets worthless.
Wired reported that shortly after partnering with TeamPCP, ShinyHunters went rogue, independently executing corporate extortions using the shared credentials without distributing financial cuts to the supply chain hackers. Despite these internal fractures, security analysts estimate that ShinyHunters’ aggressive extortion spree throughout the year positions the syndicate to pull in nearly $100 million in illicit payouts by the end of 2026.
Unlike financially motivated peers, van der Stap previously maintained that his actions were driven primarily by an obsession with digital accumulation rather than monetary gain. Speaking with journalists in 2024, he explained that his attacks were fueled by a desire to curate the most comprehensive archive of stolen databases in existence. "The hacking was very easy for me, and it wasn’t a compulsion," he stated. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap once volunteered, disclosed an internal cybersecurity incident involving the potential malicious deployment of artificial intelligence. While the nonprofit released limited details regarding the breach, a DIVD spokesperson confirmed that the incident bore no relation to ShinyHunters and showed no indication of involvement by former volunteers.
The Dutch National Police formally confirmed the arrest of the 24-year-old suspect in connection with the ongoing ShinyHunters investigation. In a public statement shared on social media, law enforcement officials announced that the suspect would appear before the chambers of the Rotterdam District Court to face formal judicial proceedings.
In an official video address released by the FBI Cyber Division, Assistant Director Brett Leatherman thanked Dutch law enforcement partners for their close collaboration and issued a direct warning to remaining members of the ShinyHunters collective.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Comments (0)