Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-profile data thefts and corporate extortions orchestrated by the prolific and aggressive hacker collective known as ShinyHunters. In the chaotic days immediately following the suspect’s detention, remaining members of the ShinyHunters network dramatically escalated their operations, executing brazen cyberattacks that included stealing highly sensitive data from the Federal Bureau of Investigation (FBI) and extorting the notorious Russian ransomware syndicate Cl0p.
According to three independent sources familiar with the matter, the Dutch man taken into custody by law enforcement is Pepijn van der Stap, a convicted cybercriminal residing in Almere and Lelystad in the Netherlands. Van der Stap previously stood trial and was convicted in 2023 for his involvement in a sweeping series of corporate data thefts and extortions. At the time, Dutch prosecutors estimated that those illicit activities generated between €1.5 million and €2.7 million in illegal proceeds.
During his late 2023 trial, van der Stap openly admitted to living a double life akin to Dr. Jekyll and Mr. Hyde. Secretly operating under the hacker handle “Umbreon,” he extorted corporate victims and published stolen data on prominent English-language dark web and underground hacking forums, including the now-defunct platforms RaidForums and Breached. By day, however, van der Stap maintained a completely respectable facade, working as a software engineer for Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization.
Van der Stap confessed fully to his data theft and extortion schemes during judicial proceedings and was subsequently sentenced to four years in prison, with one year suspended. Demonstrating the complexity of his personal situation, van der Stap opted to remain in custody for a period rather than return home, explaining to the court that he could not find comparable medical and psychological treatment on the outside for ongoing mental health struggles, which included post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a genuinely reformed individual who was actively trying to turn his life around and make positive, constructive contributions to society. At the time of his recent detention, van der Stap was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple requests for comment from journalists.
During that same interview, van der Stap noted that he was still navigating complex civil lawsuits and court-mandated restitution associated with his past cybercrime offenses, insisting he was doing everything in his power to make amends to his victims. However, shortly after that conversation concluded, the Dutch hacker abruptly ceased all communication. Repeated attempts by close acquaintances and colleagues to reach him over a two-week period went entirely unanswered.
According to two sources with direct knowledge of the investigation, van der Stap was arrested by Dutch law enforcement on or around September 16 and has been held in custody for intensive questioning ever since. One source reported that a colleague personally witnessed Dutch authorities carting boxes of evidence and electronic equipment out of van der Stap’s residential property.
For months, Dutch law enforcement agencies have actively pursued leads in connection with the ShinyHunters network, going so far as to make public appeals for assistance. Earlier in September, the Dutch National Police published a recorded telephone call from February 2026, asking the public to help identify a native Dutch-speaking voice. In that audio recording, a ShinyHunters operative successfully used sophisticated social engineering tactics to breach Odido, the largest mobile telecommunications provider in the Netherlands. During that intrusion, the hackers tricked an Odido employee into authenticating credentials on a spoofed phishing website, allowing the syndicate to siphon off personal data belonging to more than 6.2 million Dutch citizens.
Responding to inquiries from regional news media outlets, representatives for ShinyHunters readily confirmed that the suspect heard in the police audio clip is indeed an active member of their decentralized collective.
“Our team member has our full support – emotionally, mentally, and financially,” the hackers stated in a message shared with the NL Times. “Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them.”
At the time, it remained unclear whether Dutch investigators had successfully matched the voice of the Odido caller to a confirmed real-world identity. The specific Dutch police unit handling the Odido investigation declined to provide comments to the press.
Simultaneously, the hacker collective lashed out aggressively against law enforcement agencies in the Netherlands. In their public statements, ShinyHunters mocked the competency of Dutch investigators, claiming the police force lacked the necessary capabilities to dismantle their infrastructure or capture their members before future operations could be launched.
FBI and Cl0p Hacks
Just days after sources indicated van der Stap was detained by Dutch authorities, ShinyHunters claimed responsibility for an extraordinarily brazen cyber intrusion targeting the FBI’s official job application portal, apply.fbijobs.gov. According to investigative reporting from 404 Media, the data exfiltrated from the portal included Social Security numbers and deeply sensitive personal information concerning more than 5,000 current and prospective FBI personnel.
Both 404 Media and Reuters confirmed that the compromised FBI records detailed specific job titles, organizational divisions, and specialized units, including special agents, threat intake examiners, major cybercrimes personnel, and investigators tasked with handling foreign state-backed cyber threats. Reuters reviewed specific documents shared by the threat actors, noting they even contained sensitive medical and psychiatric files belonging to FBI staff members. The bureau subsequently issued a brief public statement confirming the compromise of the recruitment portal.
According to ShinyHunters, access to the FBI job site and numerous other corporate victims was achieved by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273, within PeopleSoft, a widely used enterprise human resources and payroll software platform developed by Oracle. Oracle moved quickly to issue security updates after the flaw was discovered, and cybersecurity firm Mandiant released specific web application firewall (WAF) rules to assist organizations unable to immediately patch their systems.
However, security researchers revealed that ShinyHunters managed to circumvent Mandiant’s defensive measures by employing a clever URL-encoding trick to bypass the suggested WAF rules. In a joint threat intelligence report published by Mandiant and the Google Threat Intelligence Group (GTIG), experts confirmed that ShinyHunters leveraged the PeopleSoft vulnerability in a massive, indiscriminate exploitation campaign affecting dozens of organizations across critical sectors, including higher education, technology, healthcare, agriculture, transportation, and government.
Intriguingly, van der Stap’s former hacker moniker, Umbreon, was hidden in plain sight within the digital artifacts left behind by the hackers during the FBI portal breach. The defacement image posted across the compromised recruitment site featured an intricate ASCII art rendition of the Pokémon character Umbreon alongside a taunting message declaring the site seized by ShinyHunters. Security analysts noted that the visual layout was nearly identical to a defacement message previously deployed by ShinyHunters during their 2020 infiltration of the English-language cybercrime forum Hackforums.
Sources close to the ongoing international investigation into ShinyHunters suggested that these high-risk attacks against the FBI and powerful ransomware syndicates represented a stark tactical shift away from the group’s historically calculated operations. This sudden volatility reportedly followed a leadership transition within the collective, brought on by a teenage cybercriminal from Amman, Jordan, known by the alias Rey.
Rey operates as a central figure within ScatteredLapsussHunters (SLSH), a hybrid cybercrime coalition that security experts describe as an amalgamation of three notorious hacking factions: Scattered Spider, LAPSUS$, and ShinyHunters. Sources noted that Rey harbored a persistent, bitter feud with the Dutch hacker regarding control over the ShinyHunters brand and its vast repositories of stolen data, leading investigators to believe that the prominent display of the Umbreon imagery during the FBI hack was an intentional maneuver by Rey to implicate van der Stap.
Rey was first publicly unmasked by cyber intelligence firm KELA in March 2025. During prior journalistic inquiries into Rey’s underground activities, reporters contacted the teenager’s father, an employee of Royal Jordanian Airlines, who merely forwarded the outreach to his son. Rey subsequently acknowledged his participation in various cyberattacks while expressing a desire to distance himself from the SLSH coalition.
Blaming Umbreon
Immediately following widespread media coverage of the FBI recruitment site breach, Rey’s primary social media accounts on X (formerly Twitter) began openly taunting both the FBI and the Cl0p ransomware syndicate. One widely circulated meme posted by the account depicted the federal agency and the Russian hacking group as the World Trade Center towers being struck by aircraft labeled with the respective incidents, while a giant, float-sized figure of the Pokémon character Umbreon loomed in the foreground.
Shortly after journalists reached out to Rey’s family for comment regarding his reported rise to leadership within ShinyHunters, the teenager’s primary social media accounts were abruptly deleted. Requests for comment directed to Rey’s father went unacknowledged.
Underlying tensions between the SLSH coalition and legacy members of ShinyHunters stem from short-lived business partnerships forged earlier in the year. According to an investigative report published by Wired, the groups briefly collaborated to monetize corporate credentials harvested by TeamPCP, an emerging supply chain hacking crew that successfully compromised numerous software supply chains but struggled to generate significant financial returns from their spoils. Two alleged leaders of TeamPCP were subsequently arrested in Australia.
While Mandiant covertly infiltrated TeamPCP and began neutralizing compromised credentials by alerting major cloud providers like Amazon and Microsoft, the cooperating cybercrime factions quickly began pointing fingers and blaming one another for the rapid invalidation of their stolen assets. According to Wired, ShinyHunters ultimately went rogue, executing independent extortion schemes using TeamPCP credentials without providing the supply-chain hackers with an agreed-upon financial cut.
Despite these illicit business dealings, cybersecurity analysts estimate that ShinyHunters has maintained a remarkably lucrative extortion streak, remaining on track to amass nearly $100 million in ransom payments throughout 2026.
In past interviews, van der Stap consistently insisted that his primary motivation was never financial gain. Instead, he described his criminal activities as an obsessive compulsion to build the world’s most comprehensive repository of stolen databases. Speaking with reporters from Bloomberg, van der Stap explained that his actions were driven by the sheer satisfaction of organizing and cataloging stolen data.
Meanwhile, the DIVD, where van der Stap once volunteered, disclosed an internal cybersecurity incident involving the potential malicious use of artificial intelligence. Although the nonprofit organization released limited details regarding the breach, a DIVD spokesperson clarified that the incident appeared entirely unrelated to ShinyHunters and bore no connection to the work of any former volunteers.
In official updates concerning the ongoing criminal proceedings, the Dutch police confirmed the arrest of the 24-year-old suspect in connection with the broader ShinyHunters investigation. Authorities announced that the man would appear before the chambers of the Rotterdam District Court as the investigation continues to unfold.
Concurrently, international law enforcement partners acknowledged the significance of the arrests. Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement thanking Dutch law enforcement for their swift assistance and warning remaining members of the ShinyHunters collective that their operational security was rapidly deteriorating.
“Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” Leatherman stated. “The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours.”
