Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-profile data thefts and corporate extortions orchestrated by the prolific and aggressive hacking collective known as ShinyHunters. The arrest has triggered a volatile chain reaction across the international cybersecurity landscape, prompting remaining members of the hacking group to dramatically escalate their campaigns. In the days immediately following the suspect’s detention, the group carried out brazen intrusions, including stealing sensitive personnel data from the United States Federal Bureau of Investigation and aggressively extorting the notorious Russian ransomware syndicate Cl0p.
According to three independent sources familiar with the matter, the individual detained by Dutch law enforcement this month is Pepijn van der Stap, a convicted cybercriminal originally from the Dutch towns of Almere and Lelystad. Van der Stap is well-known to European law enforcement agencies, having been previously convicted in 2023 for his involvement in an extensive string of corporate data thefts and extortions. Prosecutors in that earlier case estimated that his illicit operations generated between €1.5 million and €2.7 million in illicit proceeds.
During his late 2023 trial, van der Stap offered a candid confession regarding his activities, describing a double life characterized by a Dr. Jekyll and Mr. Hyde existence. By night, he secretly operated under the hacker handle “Umbreon,” using English-language cybercrime forums such as the now-defunct RaidForums and Breached to extort corporate victims and auction off stolen databases. By day, however, van der Stap maintained a conventional professional facade, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also dedicated his time to volunteering with the Dutch Institute for Vulnerability Disclosure, a prominent nonprofit security research organization dedicated to identifying and mitigating software vulnerabilities.
Van der Stap’s confession during his trial led to a four-year prison sentence, with one year suspended. Unconventionally, during the legal proceedings, van der Stap chose to remain in custody rather than return home, citing a lack of comparable access on the outside to treatment for his ongoing psychological struggles, which included post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap sought to cast himself as a reformed individual genuinely attempting to turn his life around and make constructive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple requests for comment. During the conversation, van der Stap noted that he was still grappling with civil lawsuits and mandatory financial restitution related to the victims of his past crimes, asserting that he was doing everything in his power to make amends.
However, shortly after that interview concluded, van der Stap abruptly stopped responding to electronic communications. Family, associates, and individuals close to him reported that he became entirely unreachable for two weeks, raising immediate concerns among his professional and personal circles.
According to two sources with direct knowledge of the investigation, Dutch authorities apprehended van der Stap on or around September 16, taking him into custody for intensive questioning. One source reported that a colleague personally witnessed law enforcement officers removing boxes and hardware from van der Stap’s residential property during the raid.
Dutch law enforcement agencies have spent months intensifying their pressure on cybercrime syndicates operating within the region. Earlier in September, authorities launched a public appeal seeking assistance in identifying a voice from a recorded telephone call made in February 2026. In that audio, a native Dutch-speaking member of ShinyHunters successfully social-engineered their way into Odido, the largest mobile telecommunications provider in the Netherlands. By tricking an Odido employee into authenticating credentials on a spoofed phishing website, the intruders exfiltrated sensitive data belonging to more than 6.2 million Dutch citizens.
In response to coverage by Dutch news media, representatives for ShinyHunters publicly confirmed that the individual whose voice appeared in the leaked police audio clip is indeed an active member of their collective. In a defiant statement shared with the NL Times, the group vowed unwavering support for their detained associate.
"Our team member has our full support — emotionally, mentally, and financially," the hackers stated. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
The group simultaneously unleashed a barrage of insults directed at Dutch law enforcement. "The Dutch police will need all the luck in the world — and everyone’s prayers — if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement read, adding derogatory remarks dismissing the capability of local investigators.
FBI and Cl0p Hacks
The arrest and subsequent fallout triggered an immediate, aggressive retaliation from the remaining leadership and operatives within ShinyHunters. Just days after sources confirmed van der Stap’s detention, the group claimed responsibility for an extraordinarily brazen cyberattack targeting the FBI’s recruitment portal, apply.fbijobs.gov.
According to reporting from 404 Media and Reuters, the data compromised during the intrusion included Social Security numbers and detailed personal information concerning more than 5,000 bureau personnel. The stolen files detailed specific job titles and operational divisions, including records associated with special agents, threat intake examiners, major cybercrime units, and personnel tasked with investigating foreign state-sponsored cyber threats. Furthermore, documents reviewed by Reuters revealed that the cache included sensitive medical and psychiatric files pertaining to FBI employees. The bureau subsequently issued a brief public statement confirming that a compromise of the job portal had taken place.
Investigators determined that ShinyHunters accessed the FBI portal and numerous other corporate systems by exploiting a critical vulnerability, tracked as CVE-2026-35273, affecting Oracle’s PeopleSoft platform. PeopleSoft is a widely utilized software-as-a-service solution leveraged by global enterprises and government agencies to manage human resources, payroll, benefits, and recruitment. Although Oracle moved quickly to issue a security patch after the flaw was actively exploited as a zero-day in June, and security firm Mandiant released protective web application firewall rules, the hackers adapted. Security researchers reported that ShinyHunters successfully bypassed mitigation controls by employing sophisticated URL-encoding tricks.
A joint threat intelligence report released on September 25 by Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters engaged in a mass-exploitation campaign leveraging the PeopleSoft vulnerability. The attacks compromised dozens of organizational networks across a diverse array of industries, spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.
The ties between the ongoing investigation and van der Stap’s past persona were highlighted in the digital artifacts left behind by the hackers. The defacement message posted on the breached FBI recruitment site prominently featured an ASCII art rendition of the Pokémon character Umbreon—van der Stap’s former online handle. The accompanying text read, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)," mirroring imagery the group previously deployed during its 2000 hack of the English-language cybercrime forum Hackforums.
Sources close to the ongoing international investigation indicated that these high-risk, provocative attacks against the FBI and foreign ransomware syndicates mark a significant departure from ShinyHunters’ historical operational style. This sudden strategic pivot coincided with a leadership transition within the collective. Intelligence analysts note that the group was recently co-opted by a teenage cybercriminal based in Amman, Jordan. Known online by the moniker "Rey," this individual operates within a hybrid cybercrime consortium called ScatteredLapsussHunters, which security experts describe as an amalgamation of operatives from Scattered Spider, LAPSUS$, and ShinyHunters.
According to insider accounts, Rey harbored a persistent rivalry and personal animosity toward van der Stap regarding control over the ShinyHunters brand and accumulated stolen data repositories. Cybersecurity analysts suggest that the conspicuous inclusion of the oversized Umbreon imagery within the FBI job site defacement was an intentional maneuver by Rey to deflect scrutiny and frame the Dutch hacker for the high-profile federal crime.
Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Prior to a detailed profile published by KrebsOnSecurity in late 2025, researchers reached out to Rey’s father, an employee of Royal Jordanian Airlines, for comment. The father simply forwarded the inquiries to his son, who subsequently admitted to participating in past ransomware operations while expressing a desire to distance himself from the cybercrime syndicate.
Following the widespread media coverage of the FBI portal breach, Rey’s primary account on X (formerly Twitter) published taunting memes directed at both the FBI and the Cl0p ransomware syndicate. One widely circulated image crudely depicted the organizations as the New York City twin towers being struck by aircraft labeled "cl0p drama" and "fbi breach claim," framed by a giant floating mascot of the Pokémon character Umbreon. Shortly after media inquiries were directed to his family regarding his alleged ascendancy within ShinyHunters, Rey’s long-standing account was abruptly deleted, and his family members ceased responding to communications from journalists.
The underlying animosity between the newer faction of hackers and traditional elements stems from prior business disputes. Earlier in the year, ShinyHunters briefly partnered with TeamPCP, an emerging gang that specialized in compromising software supply chains but struggled to monetize stolen corporate credentials effectively. Although TeamPCP leaders were eventually arrested in Australia, investigations revealed that Mandiant analysts had infiltrated the group, secretly burning stolen API keys and credentials by feeding them directly to cloud providers such as Amazon and Microsoft to invalidate them instantly.
As the credentials rapidly lost their value, the allied cybercrime factions turned on one another. Security researchers reported that ShinyHunters went rogue, leveraging TeamPCP’s stolen credentials to execute independent extortion operations while cutting out their partners. Despite these internal frictions, threat intelligence assessments indicate that ShinyHunters has maintained a lucrative extortion streak, remaining on track to pull in nearly $100 million from corporate victims throughout 2026.
For his part, van der Stap historically maintained that his motivations were driven less by immediate financial gain and more by an obsessive compulsion to acquire data. In previous interviews, he noted that his primary objective was building an exhaustive digital archive of stolen corporate databases rather than enriching himself through extortion.
Meanwhile, related institutions have faced collateral disruptions. The Dutch Institute for Vulnerability Disclosure disclosed an internal cybersecurity incident involving the suspected malicious use of artificial intelligence. However, representatives for the nonprofit clarified that the incident bore no connection to ShinyHunters and showed no ties to van der Stap’s prior tenure as a volunteer.
Law enforcement pressure continues to mount globally. The Dutch police confirmed the formal detention of the 24-year-old suspect, announcing that he would appear before the Rotterdam District Court to face ongoing interrogation regarding the broader conspiracy. Furthermore, investigative reports from Dutch outlet RTL indicated that authorities are actively reviewing suspicions that van der Stap may have attempted to orchestrate multiple murders abroad.
In tandem with the European arrests, high-ranking international law enforcement officials emphasized their commitment to dismantling the remaining infrastructure of the hacking collective. Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement commending Dutch law enforcement for their decisive collaboration and issuing a direct warning to the remaining members of ShinyHunters.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
