Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions carried out by the prolific hacker collective known as ShinyHunters. In the turbulent days immediately following the suspect’s apprehension, remaining members of the ShinyHunters network dramatically escalated their global cyber offensive, executing high-profile intrusions that included stealing highly sensitive personnel data from the Federal Bureau of Investigation (FBI) and extorting the Russian-speaking ransomware syndicate Cl0p.
According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a convicted cybercriminal originally from Almere and Lelystad in the Netherlands. Van der Stap previously faced prosecution and a subsequent conviction in 2023 for his role in a sprawling series of corporate data thefts and extortions. Dutch prosecutors at the time estimated that those illicit operations generated between €1.5 million and €2.7 million in ill-gotten gains.
During his court proceedings in late 2023, van der Stap candidly admitted to living a modern-day Dr. Jekyll and Mr. Hyde existence. By night, he secretly operated under the hacker handle “Umbreon,” using the moniker to extort corporate victims and dump stolen data caches on English-language cybercrime forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a respectable professional profile as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also dedicated his time as a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), a prominent nonprofit security research organization dedicated to identifying and mitigating software vulnerabilities.
Van der Stap confessed openly to his extensive data theft and extortion activities during his trial, ultimately receiving a four-year prison sentence, of which one year was suspended. During the legal proceedings, van der Stap made the unusual choice to remain in custody rather than return home under house arrest, telling the court that he could not find comparable treatment on the outside for his ongoing psychological struggles. He maintained that these issues included severe post-traumatic stress disorder stemming from childhood trauma. Following his sentence, he was released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a fundamentally reformed individual who was earnestly trying to turn his life around and make a positive, constructive contribution to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple requests for comment from journalists.
During that conversation, van der Stap noted that he was still grappling with ongoing civil lawsuits and financial restitution demands tied to the victims of his past cybercrimes, insisting he was doing his utmost to make amends. However, shortly after that media interaction, the Dutch hacker abruptly ceased replying to electronic messages. Efforts by acquaintances and associates to reach him repeatedly failed over the course of the following two weeks.
According to two separate sources with direct knowledge of the ongoing investigation, van der Stap was arrested by Dutch law enforcement officers on or around September 16 and has since been held in secure custody for intensive questioning. One source reported that a colleague personally witnessed Dutch authorities carting physical items and electronic equipment out of van der Stap’s residential address.
Law enforcement agencies in the Netherlands had previously launched a public appeal seeking assistance in identifying a native Dutch-speaking member of ShinyHunters whose voice was captured in a recorded telephone call from February 2026. In that audio clip, the individual successfully social-engineered their way into Odido, the largest mobile telecommunications provider in the Netherlands. During the intrusion, the hacker tricked an Odido employee into authenticating their credentials on a spoofed, malicious website, subsequently leveraging that unauthorized access to steal personal data belonging to more than 6.2 million Dutch citizens.
Responding to inquiries from Dutch news media outlets, representatives for ShinyHunters confirmed that the suspect heard in the police-released audio clip is indeed an active member of their decentralized hacker collective.
"Our team member has our full support – emotionally, mentally, and financially," the hackers declared in an official statement shared with the NL Times. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
It remains unclear whether Dutch police have successfully matched the voice from the Odido social engineering call to a confirmed, legal identity in the physical world. The specialized Dutch police unit handling the Odido investigation declined to respond to repeated requests for comment.
At the same time, the collective launched a scathing verbal assault against Dutch law enforcement. "The Dutch police will need all the luck in the world – and everyone’s prayers – if they want to catch him before we carry out another large-scale data theft in the Netherlands," the ShinyHunters statement read. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
FBI and CL0P Cyberattacks
Just days after sources indicated van der Stap was detained by Dutch authorities, ShinyHunters publicly claimed responsibility for an unusually brazen and disruptive breach targeting the FBI’s official job application portal, apply.fbijobs.gov. According to reporting from 404 Media and Reuters, the stolen data extracted from the federal agency’s portal included Social Security numbers and detailed personal information concerning more than 5,000 personnel.
The compromised records reportedly detailed specific job titles and internal assignments, encompassing special agents, threat intake examiners, members of major cybercrimes units, and personnel tasked with investigating state-backed foreign cyber threats. Furthermore, Reuters examined internal documents shared directly by the hackers, confirming they contained sensitive psychiatric and medical files belonging to FBI employees. The bureau subsequently issued a brief public statement acknowledging the unauthorized compromise of the portal.
ShinyHunters stated that they gained access to the FBI infrastructure and other target networks by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widely utilized enterprise software-as-a-service platform developed by Oracle, heavily relied upon across global industries for human resources, recruitment, employee benefits, and payroll management. Oracle moved quickly to deploy a security patch for the PeopleSoft vulnerability after discovering that ShinyHunters had been actively weaponizing it as a zero-day since June. Concurrently, cybersecurity firm Mandiant released specialized web application firewall (WAF) rules designed to protect organizations unable to immediately apply the official software update.
However, security researchers reported that ShinyHunters managed to circumvent Mandiant’s defensive mitigations by deploying a clever URL-encoding trick to bypass the WAF rules. In a joint threat intelligence report released on September 25, analysts from Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters executed a mass-exploitation campaign targeting the PeopleSoft flaw, successfully compromising dozens of systems across diverse industry sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Intriguingly, van der Stap’s former hacker alias, Umbreon, was hidden in plain sight within the digital imagery deployed by ShinyHunters to publicize the FBI breach. The customized defacement landing page left behind on the compromised FBI jobs portal featured an intricate ASCII art graphic depicting the Pokémon character Umbreon. At the top of the graphic, a bold message read: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." The visual layout appeared virtually identical to a defacement banner previously utilized by the group during its 2020 compromise of the English-language cybercrime forum Hackforums.
Multiple sources close to the international investigation into ShinyHunters noted that the group’s recent, highly risky attacks against federal law enforcement and the notoriously aggressive Cl0p ransomware syndicate represent a dramatic pivot away from the more measured, financially driven strategy that previously characterized the collective’s operations. Investigators indicate this sudden strategic shift materialized following an internal power struggle and subsequent takeover of the group by a teenage cybercriminal from Amman, Jordan. Operating under the online moniker "Rey," this individual is a core figure within a loose coalition known as ScatteredLapsussHunters (SLSH), which security experts describe as an operational amalgamation of three notorious cybercrime factions: Scattered Spider, LAPSUS$, and ShinyHunters.
Sources familiar with underground dynamics stated that Rey had a prolonged personal and operational feud with the Dutch hacker regarding control over the ShinyHunters brand and its vast data repositories. Consequently, the prominent inclusion of the oversized Umbreon Pokémon imagery in the FBI site defacement was widely interpreted as a deliberate tactical move by Rey to pin the high-profile federal breach squarely on the detained Dutchman.
Rey was first publicly unmasked by cyber intelligence firm KELA in March 2025. Ahead of a subsequent journalistic profile published in late 2025, researchers contacted Rey’s father to request an interview with his teenage son. Rather than intervening, the father reportedly forwarded the inquiry directly to the youth, who subsequently acknowledged participating in various ransomware operations while claiming he was actively trying to disassociate himself from the SLSH collective.
Blaming Umbreon
Immediately following widespread media coverage of the FBI jobs portal intrusion, Rey’s primary social media account on X taunted both the Cl0p ransomware faction and federal investigators. One widely circulated meme crudely depicted the groups as the World Trade Center towers being struck by commercial aircraft labeled with text referencing the ongoing drama. In the foreground of the digital artwork, a giant, float-sized rendering of the Pokémon character Umbreon loomed large.
On September 24, journalists again contacted Rey’s father to request an interview regarding his son’s apparent ascent to leadership within ShinyHunters. Just hours after that message was delivered, Rey deleted his long-standing social media presence. Meanwhile, his father, an employee of Royal Jordanian Airlines, failed to respond to numerous subsequent email inquiries regarding his son’s alleged illicit digital activities.
The underlying animosity between the SLSH faction and core members of ShinyHunters traces back to a brief, unstable partnership earlier in the year. According to investigative reports, the groups had temporarily aligned to better monetize valuable corporate credentials amassed by TeamPCP, an upstart hacking outfit that specialized in compromising global software supply chains with malicious code. Despite successfully breaching numerous corporate networks, TeamPCP had struggled to extract substantial financial payouts from their stolen data assets. Two alleged leaders of TeamPCP were subsequently arrested in Australia, with one admitting during interrogation that the group had netted a meager $20,000 from their operations.
Security analysts later revealed that Mandiant had successfully infiltrated TeamPCP’s operations and covertly orchestrated the rapid invalidation of their stolen credentials. By secretly feeding compromised access keys to major cloud infrastructure providers like Amazon and Microsoft, security teams rendered the stolen credentials useless almost immediately. As the partnership unraveled, the cooperating hacker factions began pointing fingers and blaming one another for the sudden devaluation of the loot.
Industry researchers noted that throughout the year, ShinyHunters pursued a lucrative extortion spree, placing the collective on a trajectory to pull in nearly $100 million in extortion payments from corporate victims by the close of 2026.
Conversely, van der Stap previously maintained throughout his legal proceedings that he was never primarily motivated by financial enrichment. Instead, he claimed his early cybercriminal activities were fueled by an obsessive drive to curate the world’s most comprehensive archive of stolen databases. In a 2024 interview with financial journalists, he explained that this singular psychological focus served as the primary catalyst for his attacks.
"The hacking was very easy for me, and it wasn’t a compulsion," van der Stap told reporters. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap previously served as a volunteer researcher, disclosed an internal cybersecurity incident involving the potential malicious utilization of artificial intelligence tools. While DIVD provided minimal public commentary regarding the breach, a spokesperson confirmed that the episode bore no connection to ShinyHunters, nor were there any indications that the matter involved the past activities of any former volunteer.
Dutch police officially confirmed the arrest of the 24-year-old suspect in connection with the ongoing ShinyHunters investigation. In a public statement issued via social media, law enforcement announced that the individual would appear before the chambers of the Rotterdam District Court as the investigation continues to unfold.
Meanwhile, prominent international law enforcement figures have stepped up public warnings to the remaining members of the hacking collective. Brett Leatherman, assistant director of the FBI’s cyber division, released a video message addressing the ShinyHunters investigation, thanking Dutch law enforcement partners for their crucial operational assistance and strongly advising remaining hackers to surrender voluntarily.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Comments (0)