Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding data thefts and extortion schemes orchestrated by the prolific and aggressive hacking collective known as ShinyHunters. The arrest, which took place in mid-September, immediately preceded a dramatic and chaotic escalation by the remaining members of the group. In the days following the detention, the hacking collective carried out high-profile breaches, targeting the United States Federal Bureau of Investigation (FBI) and launching retaliatory extortion attacks against the prominent Russian-speaking ransomware group Cl0p.
According to multiple sources familiar with the matter, the individual detained by Dutch law enforcement is Pepijn van der Stap, a convicted cybercriminal originally from the Dutch municipalities of Almere and Lelystad. Van der Stap previously faced prosecution in 2023 for his involvement in an extensive series of data thefts and extortion plots that Dutch prosecutors estimated yielded between €1.5 million and €2.7 million in illicit proceeds.
During his late 2023 trial, van der Stap admitted to leading a double life. While publicly employed by day as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, and volunteering with the nonprofit Dutch Institute for Vulnerability Disclosure (DIVD), he secretly operated under the hacker handle "Umbreon." Using this persona, he extorted victims and published stolen corporate and personal databases on English-language cybercrime forums, including the now-defunct platforms RaidForums and Breached.
Van der Stap confessed openly to his crimes during judicial proceedings and was ultimately sentenced to four years in prison, with one year suspended. During the trial, he requested to remain in custody rather than serving time under home detention, citing better access to treatment for ongoing psychological challenges, including post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a reformed individual attempting to rebuild his life and make positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that has not responded to requests for comment. Van der Stap noted during the conversation that he was still navigating civil lawsuits and restitution related to his past criminal convictions, emphasizing that he was making every effort to make amends. However, communications abruptly ceased shortly after the interview, and associates were unable to reach him for two weeks.
Sources familiar with the investigation confirmed that Dutch law enforcement detained van der Stap on or around September 16, holding him in custody for questioning. Witnesses reported seeing law enforcement personnel removing items from his residence during the operation.
Law enforcement in the Netherlands had previously launched public appeals to identify a native Dutch speaker whose voice was captured in a recorded telephone call from February 2026. In that incident, a ShinyHunters operative used social engineering tactics to compromise Odido, the country’s largest mobile telecommunications provider, tricking an employee into logging into a spoofed website. The intrusion resulted in the theft of sensitive data belonging to more than 6.2 million Dutch citizens.
When contacted by local media, ShinyHunters confirmed that the voice in the audio recording belonged to a member of their collective. In a public statement shared with the NL Times, the group expressed staunch support for their arrested associate, stating that he had their full emotional, mental, and financial backing, complete with retained criminal defense representation. The group also directed harsh criticism at Dutch authorities, dismissing the competence of local law enforcement units. The Dutch police unit managing the Odido investigation declined to comment on whether investigators had conclusively linked the audio recording to a specific individual.
FBI and Cl0p Exploits
Just days after van der Stap’s detention, ShinyHunters claimed responsibility for an unusually brazen intrusion targeting the FBI’s job application portal, apply.fbijobs.gov. According to reports from 404 Media and Reuters, the breach exposed personally identifiable information, including Social Security numbers, for more than 5,000 applicants and current personnel.
The compromised records included specific job titles and organizational assignments, such as special agents, threat intake examiners, and personnel assigned to major cybercrimes units and foreign state-backed threat investigations. Reuters reviewed documents shared by the hackers that reportedly contained sensitive medical and psychiatric files belonging to FBI personnel. The bureau subsequently issued a brief public statement acknowledging the unauthorized access and compromise of its recruitment portal.
According to security analysts, the group gained initial access to the FBI site and other targeted systems by weaponizing a recently patched vulnerability, cataloged as CVE-2026-35273, affecting PeopleSoft, an enterprise human resources and payroll platform developed by Oracle. Oracle deployed a rapid security update to address the flaw after identifying that ShinyHunters had been actively exploiting it as a zero-day vulnerability since June. While security firms like Mandiant issued web application firewall (WAF) mitigation rules for organizations unable to immediately patch their systems, BleepingComputer reported that ShinyHunters successfully bypassed those defenses using URL-encoding manipulation techniques.
A joint threat intelligence report published on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters carried out a mass-exploitation campaign leveraging the PeopleSoft vulnerability. The attacks impacted dozens of systems across multiple sectors, including higher education, healthcare, technology, agriculture, transportation, and government agencies.
The FBI portal defacement left behind by the hackers prominently featured visual markers tied to van der Stap’s former alias. The page displayed an ASCII art design of the Pokémon character Umbreon alongside a seized notice reading, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." The imagery closely mirrored defacement messages the group used during previous campaigns, such as their 2020 intrusion into Hackforums.
Security researchers tracking the collective indicated that the high-risk, aggressive strategy targeting the FBI and the Russian-speaking Cl0p ransomware syndicate marked a significant departure from the group’s usual operational tenor. Investigators attribute this pivot to a leadership transition following a takeover by a teenage cybercriminal based in Amman, Jordan. Operating under the alias "Rey," this individual is affiliated with a consolidated cybercrime umbrella organization known as ScatteredLapsussHunters, which security experts describe as a coalition uniting elements of Scattered Spider, LAPSUS$, and ShinyHunters.
Sources familiar with the matter stated that Rey maintained a persistent rivalry with van der Stap over control of the ShinyHunters brand and associated databases. Analysts believe the prominent inclusion of the Umbreon imagery in the FBI portal defacement was an intentional effort to implicate the detained Dutch hacker. Rey was first unmasked publicly by cybersecurity firm KELA in March 2025, and subsequent investigative profiles revealed admissions of participation in high-level ransomware campaigns alongside efforts to distance himself from the coalition.
Blaming Umbreon
Following widespread media coverage of the FBI portal breach, accounts linked to Rey on social media platforms taunted both the bureau and the Cl0p ransomware faction, publishing inflammatory memes juxtaposed with graphics of the Umbreon character. Shortly after inquiries were made by journalists regarding Rey’s elevated role within ShinyHunters, the associated social media accounts were deactivated, and family members connected to the individual did not respond to requests for comment.
The friction between the coalition factions traces back to earlier operational partnerships. According to a report by Wired, members of ShinyHunters and the ScatteredLapsussHunters coalition temporarily collaborated earlier in the year to monetize credentials stolen by TeamPCP, an upstart supply-chain hacking group that had struggled to convert access into financial returns. While TeamPCP members were ultimately arrested by Australian authorities, investigations revealed that Mandiant analysts had secretly infiltrated the group’s infrastructure, feeding compromised credentials directly to cloud providers such as Amazon and Microsoft to invalidate stolen keys.
As the credentials were rapidly burned, the allied criminal factions began accusing one another of sabotaging the operations. Reports indicated that ShinyHunters eventually bypassed its partners entirely, utilizing the stolen supply-chain credentials to execute independent extortion schemes. Mandiant researchers noted that these campaigns positioned ShinyHunters to generate nearly $100 million in extortion proceeds throughout the year.
While prosecutors and investigators focused on the financial motivations behind these cyberattacks, van der Stap consistently maintained that monetary gain was not his primary driver. In prior interviews with media outlets, he described his criminal activities as an extension of a compulsive desire to acquire, organize, and archive large volumes of leaked databases.
Meanwhile, the Dutch Institute for Vulnerability Disclosure addressed an internal cybersecurity incident involving the potential malicious use of artificial intelligence. A spokesperson for the nonprofit clarified that the internal matter was unrelated to ShinyHunters and showed no connection to van der Stap’s past volunteer work with the organization.
Later in the day, the Dutch police officially confirmed the arrest of a 24-year-old individual in connection with the ongoing ShinyHunters investigation. Authorities announced that the suspect would appear before the Rotterdam District Court, with further details to be released following the hearing.
