Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions orchestrated by the prolific hacker collective known as ShinyHunters. The high-profile arrest has sent immediate shockwaves through the cybercriminal underground, prompting remaining ShinyHunters members to dramatically escalate their global campaign. In the days following the detention, the group carried out a series of audacious operations, including stealing highly sensitive data from the Federal Bureau of Investigation (FBI) and turning its sights toward extorting the notorious Russian ransomware syndicate Cl0p.

According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a convicted cybercriminal residing in Almere and Lelystad in the Netherlands. Van der Stap was previously convicted in 2023 for his involvement in a sweeping string of data thefts and digital extortions that Dutch prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds.

During his trial in late 2023, van der Stap candidly admitted to living a dual life akin to Dr. Jekyll and Mr. Hyde. By night, he secretly utilized the hacker handle “Umbreon”—named after the Pokémon character—to extort corporate victims and dump stolen databases onto prominent English-language hacking forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a respectable professional facade, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization.

Van der Stap confessed openly to his role in the data thefts and extortions, ultimately receiving a four-year prison sentence, with one year suspended. Bizarrely, during the course of his legal proceedings, van der Stap elected to remain in custody rather than return home, explaining to the court that he could not find adequate treatment on the outside for his ongoing psychological struggles, which he asserted included post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.

In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a fundamentally reformed individual who was actively working to turn his life around and make positive, constructive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple requests for comment.

During that same conversation, van der Stap noted that he was still navigating complex civil lawsuits and restitution requirements tied to his historical cybercrime victims, emphasizing that he was trying his absolute best to make amends. However, shortly after the interview concluded, the Dutch hacker abruptly ceased all communication. Efforts by professional colleagues and personal acquaintances to reach him repeatedly failed over the following two weeks.

According to two sources with direct knowledge of the investigation, van der Stap was arrested by Dutch authorities on or around September 16 and has remained in custody for intensive questioning. One source noted that a colleague personally witnessed Dutch law enforcement officers carting physical items and electronic equipment out of van der Stap’s residence during the raid.

For months, Dutch law enforcement agencies have been actively seeking public assistance in identifying a key voice in a recorded telephone conversation from February 2026. In that call, a native Dutch-speaking member of ShinyHunters successfully social-engineered their way into Odido, the largest mobile telecommunications provider in the Netherlands. During the intrusion, the hacker tricked an Odido employee into authenticating at a spoofed phishing website, leveraging that fraudulent access to exfiltrate sensitive data belonging to more than 6.2 million Dutch citizens.

Responding to inquiries from local news media, ShinyHunters explicitly confirmed that the individual heard in the released audio clip is indeed a core member of their collective. In a public statement shared with the NL Times, the group expressed total solidarity with their detained associate. "Our team member has our full support — emotionally, mentally, and financially," the hackers declared, adding that a high-powered criminal defense attorney had already been secured. "Everything has been arranged… We do not look down on our staff and members; we take excellent care of them."

At the same time, the collective lashed out viciously at Dutch law enforcement. "The Dutch police will need all the luck in the world — and everyone’s prayers — if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement sneered, dismissing the investigating authorities as incompetent and irrelevant.

FBI and CL0P Hacks

Just days after sources indicate van der Stap was detained by Dutch authorities, ShinyHunters shocked the cybersecurity community by claiming responsibility for an extraordinarily brazen breach targeting the FBI’s employment portal, apply.fbijobs.gov. Reporting from 404 Media and Reuters revealed that the exfiltrated records included Social Security numbers and deeply personal background information concerning more than 5,000 bureau personnel.

The stolen FBI records contained specific job titles and operational team assignments, identifying agents working in specialized fields such as special agents, threat intake examiners, major cybercrimes units, and personnel dedicated to investigating cyber threats originating from foreign state-backed adversaries. Furthermore, Reuters examined documents leaked by the group and confirmed they included sensitive psychiatric and medical files pertaining to FBI employees. The bureau subsequently issued a brief statement confirming the compromise of the portal.

According to ShinyHunters, access to the FBI portal and numerous other victim networks was achieved by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft—a widely utilized enterprise software-as-a-service platform managed by tech giant Oracle for human resources, recruitment, payroll, and benefits administration. Oracle moved quickly to deploy a security update after the flaw was actively targeted as a zero-day exploit in June, while security firm Mandiant issued web application firewall (WAF) rules to assist organizations unable to immediately apply the patch.

However, security researchers at BleepingComputer reported that ShinyHunters subsequently utilized a sophisticated URL-encoding trick to successfully bypass Mandiant’s recommended WAF mitigation rules. In a joint technical report released on September 25, experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that the group had engaged in a mass-exploitation campaign, leveraging the PeopleSoft vulnerability to infiltrate and extract data from dozens of enterprise systems spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.

Van der Stap’s former hacker alias, Umbreon, was prominently hidden in plain sight within the digital artifacts left behind during the FBI portal breach. The defacement image posted by ShinyHunters featured custom ASCII art depicting the Pokémon character Umbreon alongside a taunting message declaring the site seized. This graphic appeared identical to the defacement banner the group used during their 2020 hack of the English-language cybercrime community Hackforums.

Sources close to the ongoing investigation into ShinyHunters noted that the group’s recent high-risk attacks against both the FBI and Cl0p marked a sharp strategic pivot away from their historical operational style. This sudden volatility followed a leadership shift wherein the group was effectively taken over by a teenage cybercriminal from Amman, Jordan, known online as "Rey." Rey operates as a prominent figure within a sprawling cybercrime syndicate called ScatteredLapsussHunters (SLSH), an amalgamation formed by members of Scattered Spider, LAPSUS$, and ShinyHunters.

Investigators indicated that Rey harbored a persistent rivalry with van der Stap regarding operational control over the ShinyHunters brand and accumulated stolen data repositories. Consequently, insiders believe the inclusion of the oversized Umbreon imagery in the FBI site defacement was a deliberate attempt by Rey to frame the imprisoned Dutch hacker.

Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. When contacted by journalists ahead of a profile published later that year, Rey’s father merely forwarded inquiries to his teenage son, who admitted to participating in ransomware activities while expressing a desire to distance himself from the SLSH collective. Following the widespread media coverage of the FBI breach, Rey’s primary social media account on X actively taunted both the bureau and Cl0p before the account was ultimately deleted. Rey’s father, an employee of Royal Jordanian Airlines, has repeatedly declined to respond to inquiries regarding his son’s alleged digital exploits.

Underlying the tensions between SLSH and ShinyHunters was a brief, unstable partnership earlier in the year designed to monetize stolen credentials harvested by TeamPCP, an upstart supply-chain hacking faction whose leaders were recently arrested in Australia. According to reporting by Wired, ShinyHunters allegedly went rogue during this collaboration, utilizing TeamPCP’s stolen credentials to execute independent extortion schemes without sharing the financial proceeds with their partners. Despite these internal friction points, Mandiant researchers noted that ShinyHunters has experienced a remarkably lucrative extortion streak, remaining on pace to accumulate nearly $100 million in illicit payouts throughout 2026.

In stark contrast to financially motivated threat actors, van der Stap previously insisted to investigators and reporters that his actions were driven primarily by an obsessive compulsion to archive data. Speaking with Bloomberg in 2024, he remarked that his primary objective was building the world’s most comprehensive collection of stolen databases rather than generating wealth.

Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed an internal cybersecurity incident involving the suspected malicious use of artificial intelligence. While the nonprofit noted that the matter remains under investigation, a spokesperson confirmed there are no indications that the security event is connected to ShinyHunters or involves the past actions of any former volunteers.

The Dutch police officially confirmed the arrest of the 24-year-old suspect in connection with the ongoing ShinyHunters probe. Authorities announced that the individual would appear before the chambers of the Rotterdam District Court, with further operational details expected to be released publicly.

Adding a severe twist to the domestic proceedings, Dutch news outlet RTL reported that investigators increasingly suspect van der Stap of attempting to orchestrate at least two murders abroad, with evidence suggesting the suspect may have directly issued orders for the killings.

Providing an international perspective on the dismantling of the cybercrime infrastructure, Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement thanking Dutch law enforcement partners for their crucial assistance while directly addressing the remaining members of ShinyHunters.

"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman warned. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."