Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and extortion schemes orchestrated by the prolific and aggressive hacker collective known as ShinyHunters. The high-profile arrest has sent shockwaves through the underground cybercrime ecosystem, triggering a dramatic and dangerous escalation from remaining ShinyHunters members. In the days immediately following the suspect’s detention, the group carried out high-stakes attacks, including stealing highly sensitive personal and medical data from the Federal Bureau of Investigation (FBI) and brazenly extorting the notorious Russian ransomware syndicate Cl0p.
According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a convicted cybercriminal originally from the Dutch towns of Almere and Lelystad. Van der Stap is hardly a stranger to European law enforcement; he was previously convicted in late 2023 for his involvement in a sweeping series of corporate data thefts and corporate extortions. According to prosecutors handling that initial case, van der Stap’s illicit activities generated between €1.5 million and €2.7 million in ill-gotten gains.
During his 2023 trial, van der Stap offered a startling confession, admitting that he had lived a literal Dr. Jekyll and Mr. Hyde existence. By night, he secretly utilized the hacker alias “Umbreon”—named after the dark-type Pokémon character—to extort corporate victims and dump stolen data onto English-language cybercrime forums, including the now-defunct markets RaidForums and Breached. By day, however, van der Stap maintained a completely respectable facade, working professionally as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He even volunteered his technical expertise with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization dedicated to identifying and mitigating software vulnerabilities.
Van der Stap fully confessed to his extensive data theft and extortion operations during his court proceedings, ultimately receiving a four-year prison sentence, of which one year was suspended. Demonstrating the complexity of his personal struggles, van der Stap actually requested to remain in correctional custody rather than serving time under home detention during a portion of his pre-trial phase, arguing that he could not find adequate medical and psychological treatment on the outside for his ongoing mental health challenges. Among these, he claimed, was post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap sought to cast himself as a thoroughly reformed individual attempting to turn his life around and make positive, constructive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple requests for media comment regarding the situation.
During that same conversation, van der Stap noted that he was still actively dealing with lingering civil lawsuits, legal fallout, and financial restitution obligations stemming from his past cybercrime activities, insisting he was doing his absolute best to make amends to those he had harmed. However, shortly after that interview concluded, van der Stap abruptly stopped responding to messages. Efforts by friends, colleagues, and associates to reach him repeatedly failed over the course of the following two weeks.
According to two independent sources with direct knowledge of the investigation, van der Stap was arrested by Dutch authorities on or around September 16 and has since been held in secure custody for intensive questioning. One source noted that a colleague personally witnessed Dutch law enforcement officers carting boxes of physical evidence and hardware out of van der Stap’s residence.
Dutch law enforcement agencies have spent much of the year intensely investigating the ShinyHunters collective, notably making public appeals for help in identifying a native Dutch-speaking voice from a recorded phone call dating back to February 2026. In that audio clip, a ShinyHunters operative successfully social-engineered their way into Odido, the Netherlands’ largest mobile telecommunications provider. During the intrusion, the hacker tricked an Odido employee into authenticating credentials at a sophisticated spoofed website, leveraging that fraudulent access to steal sensitive personal data belonging to more than 6.2 million Dutch citizens.
Reacting to local news coverage, representatives for ShinyHunters publicly confirmed that the suspect heard in the police audio clip is indeed an active member of their hacker collective.
"Our team member has our full support – emotionally, mentally, and financially," the hackers declared in a public statement shared with the Dutch media outlet NL Times. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
At the time, it remained unclear whether Dutch investigators had successfully linked the voice of the Odido caller to a confirmed, real-world identity. The specialized Dutch police unit managing the Odido investigation declined to comment on ongoing operational details.
At the same time, the collective lashed out aggressively at law enforcement officials in the Netherlands. "The Dutch police will need all the luck in the world – and everyone’s prayers – if they want to catch him before we carry out another large-scale data theft in the Netherlands," the ShinyHunters statement warned. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
FBI and CL0P Hacks
Just days after sources confirmed van der Stap had been detained by Dutch authorities, ShinyHunters claimed responsibility for an unusually brazen and high-profile breach targeting the FBI’s official job application portal, apply.fbijobs.gov. According to reporting from 404 Media, the stolen information extracted from the FBI portal included Social Security numbers and highly sensitive personal background data belonging to more than 5,000 bureau officials and applicants.
Reports from 404 Media and Reuters revealed that the compromised FBI records contained granular details regarding each person’s specific job title, assignment, or operational team. These included individuals assigned to special agent roles, threat intake examiners, major cybercrimes divisions, and specialized personnel tasked with investigating state-sponsored foreign cyber threats. Furthermore, Reuters examined documentation shared directly by the hackers and confirmed it contained sensitive psychiatric and medical files pertaining to FBI personnel. In response to the breach, the bureau issued a brief, formal statement acknowledging the compromise of the recruitment portal and the alleged impact on employee personally identifiable information (PII).
According to ShinyHunters, access to the FBI site and numerous other corporate victims was achieved by weaponizing a recently patched critical vulnerability, tracked as CVE-2026-35273, impacting PeopleSoft. PeopleSoft is a widely utilized enterprise software-as-a-service platform owned by technology giant Oracle, heavily relied upon across global industries for human resources, recruitment, benefits administration, and payroll processing. Oracle swiftly issued an emergency patch for the flaw after discovering that ShinyHunters had been actively exploiting it as an undocumented zero-day vulnerability since June. Concurrently, security firm Mandiant released specialized web application firewall (WAF) rules designed to protect organizations that could not apply the official software update immediately.
However, security researchers revealed that ShinyHunters managed to circumvent these protective measures. BleepingComputer reported that the group utilized a clever URL-encoding trick to successfully bypass Mandiant’s mitigation rules. In a comprehensive threat intelligence report released on September 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had conducted a mass-exploitation campaign targeting the PeopleSoft vulnerability, successfully extracting proprietary data from dozens of enterprise systems across higher education, technology, healthcare, agriculture, transportation, and government sectors.
Significantly, van der Stap’s former hacker moniker, Umbreon, was hidden in plain sight within the digital artifacts left behind by the hackers. The defacement splash page posted by ShinyHunters on the compromised FBI jobs portal featured an intricate ASCII art graphic depicting the Pokémon character Umbreon. Surrounding the imagery was a taunting message reading, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Security analysts noted that the defacement asset was nearly identical to a visual signature used by ShinyHunters during their 2020 compromise of the English-language cybercrime community HackForums.
Multiple sources close to the international investigation into ShinyHunters noted that the group’s recent, highly aggressive attacks against both the FBI and a major ransomware cartel represented a radical departure from the gang’s traditionally calculated operational style. Industry experts attributed this sudden shift to an internal leadership coup, wherein ShinyHunters was effectively taken over by a teenage cybercriminal based in Amman, Jordan. Operating under the alias "Rey," this individual is a core member of an umbrella cybercrime syndicate known as ScatteredLapsussHunters (SLSH)—a coalition formed from the remnants of three notorious hacking brands: Scattered Spider, LAPSUS$, and ShinyHunters.
According to insider sources, Rey harbored a persistent grudge against van der Stap regarding control over the ShinyHunters brand equity and accumulated data repositories. Consequently, analysts believe the inclusion of the oversized Umbreon Pokémon graphic in the FBI portal defacement was an intentional tactical maneuver by Rey designed to frame the Dutch hacker and draw immediate law enforcement heat toward him.
Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Ahead of a subsequent investigative profile published in late 2025, security journalists contacted Rey’s father to request an interview with the teenage hacker. Rather than blocking the inquiry, the father reportedly forwarded the message directly to his son, who subsequently admitted to participating in high-profile ransomware attacks while simultaneously claiming he was trying to distance himself from the SLSH collective.
Blaming Umbreon
Immediately following widespread media coverage of the FBI jobs site breach, Rey utilized his primary social media account on X (formerly Twitter) to openly taunt both the FBI and the Cl0p ransomware syndicate. One particularly provocative meme shared by the account depicted the FBI and Cl0p as the World Trade Center twin towers being struck by descending aircraft labeled "cl0p drama" and "fbi breach claim," while a giant, float-sized rendering of the Pokémon character Umbreon loomed prominently in the foreground.
On September 24, reporters again contacted Rey’s father, seeking an interview regarding Rey’s apparent rise to leadership within ShinyHunters. Just hours after that inquiry was delivered, Rey abruptly deleted his long-standing X account. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, has failed to respond to numerous email requests for comment regarding his son’s alleged orchestration of international cyberattacks.
The underlying hostility between SLSH and traditional ShinyHunters factions stems from a brief, volatile partnership earlier in the year. According to an in-depth investigation published by Wired, members of ShinyHunters and SLSH briefly joined forces to better monetize valuable corporate credentials harvested by TeamPCP. TeamPCP was an upstart hacking cell that specialized in compromising global software supply chains with malicious code, though they had struggled to effectively monetize their stolen data—with alleged leaders later claiming they netted a mere $20,000 before two key figures were arrested by Australian authorities in August.
As Wired reported, Mandiant had covertly infiltrated TeamPCP’s operations and was secretly responsible for burning the group’s stolen credentials by feeding them directly to major cloud infrastructure providers like Amazon and Microsoft, prompting immediate invalidation of the keys. This interference sparked fierce paranoia within the cooperating cybercrime factions, with members quickly accusing one another of leaking access and rendering the stolen data worthless.
Mandiant researcher Austin Larsen noted that despite internal friction, ShinyHunters has enjoyed a remarkably lucrative extortion spree throughout the year, remaining on track to pull in nearly $100 million in extortion payouts from corporate victims globally by the end of 2026.
Unlike financially driven syndicate leaders, van der Stap historically maintained that his hacking activities were driven primarily by an obsessive compulsion to acquire data rather than monetary gain. Speaking with journalists from Bloomberg in 2024, van der Stap explained that his primary motivation was building the world’s most comprehensive archive of stolen databases.
"The hacking was very easy for me, and it wasn’t a compulsion," van der Stap told Bloomberg during a previous interview. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap previously volunteered, disclosed an internal cybersecurity incident involving the potential malicious use of artificial intelligence. While DIVD released few technical specifics regarding the breach, a spokesperson confirmed to security researchers that the internal incident appeared entirely unrelated to ShinyHunters, nor were there any indications that the matter involved the past activities of their former volunteer.
Developments in the case continued to multiply as Dutch police officially confirmed the arrest of a 24-year-old suspect tied to the ongoing ShinyHunters investigation. In an official statement shared on X, law enforcement officials announced that the suspect would appear before the chambers of the Rotterdam District Court.
Shortly thereafter, Dutch news outlet RTL reported that investigators had uncovered an even darker twist, revealing that authorities suspect van der Stap attempted to orchestrate at least two contract murders overseas, with emerging indications suggesting he gave direct orders for the killings to be carried out.
Concurrently, the FBI released a formal video statement addressing the sweeping international investigation into ShinyHunters. Brett Leatherman, assistant director of the FBI’s cyber division, thanked Dutch law enforcement partners for their crucial assistance and issued a direct warning to the remaining members of the hacker collective who still remain at large.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Comments (0)