Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-profile data thefts and corporate extortions orchestrated by the prolific and aggressive hacking collective known as ShinyHunters. The detention has triggered a dramatic and volatile escalation from the remaining members of the group, who launched a wave of retaliatory digital assaults—including a brazen breach of the Federal Bureau of Investigation’s job application portal and the extortion of the notorious Russian ransomware syndicate Cl0p—in the days immediately following the arrest.
According to three independent sources familiar with the matter, the Dutch man taken into custody by law enforcement is Pepijn van der Stap, a previously convicted cybercriminal residing in Almere and Lelystad in the Netherlands. Van der Stap’s notoriety in the cybersecurity community is not new; he was convicted in 2023 for his involvement in an extensive string of corporate data thefts and extortions. According to Dutch prosecutors, those prior illicit operations generated between €1.5 million and €2.7 million in illegal proceeds.
During his late 2023 trial, van der Stap offered a candid admission of his dual existence, describing a life akin to Dr. Jekyll and Mr. Hyde. By night, he operated under the hacker handle "Umbreon," utilizing English-language cybercrime forums—specifically the now-defunct platforms RaidForums and Breached—to extort corporate victims and leak stolen databases. By day, however, van der Stap maintained a completely legitimate professional facade, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also dedicated his time as a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), a prominent nonprofit security research organization dedicated to identifying and resolving software vulnerabilities.
Van der Stap confessed to his extensive role in data theft and extortion during the judicial proceedings, ultimately receiving a four-year prison sentence, with one year suspended. In a peculiar twist during his legal proceedings, van der Stap chose to remain in custody rather than return home while awaiting trial, stating that he could not find adequate medical and psychological treatment outside of detention for his ongoing mental health struggles, which he attributed to post-traumatic stress disorder stemming from childhood trauma. Following his sentence, he was released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap presented himself as a thoroughly reformed individual striving to rebuild his life and contribute positively to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that has declined to respond to media requests for comment regarding the situation.
During the conversation, van der Stap noted that he was still navigating complex civil lawsuits and court-ordered restitution tied to the victims of his past cybercrimes, emphasizing that he was making every effort to make amends. However, shortly after that discussion, van der Stap abruptly ceased all communication. Repeated attempts by associates and colleagues to reach him over a two-week period went completely unanswered.
According to two sources with direct knowledge of the investigation, van der Stap was arrested by Dutch law enforcement on or around September 16 and has since been held in custody for intensive questioning. One source reported that a colleague personally witnessed Dutch authorities removing boxes and technical equipment from van der Stap’s residence during the raid.
Law enforcement agencies across the Netherlands have been actively pursuing leads in connection with the ShinyHunters network. Earlier in September, Dutch police appealed to the public for assistance in identifying a voice from a recorded telephone call intercepted in February 2026. In the audio, a native Dutch-speaking member of ShinyHunters successfully social-engineered their way into Odido, the nation’s largest mobile telecommunications provider. During that intrusion, the threat actor deceived an Odido employee into authenticating on a spoofed phishing website, utilizing the compromised credentials to steal sensitive personal records belonging to more than 6.2 million Dutch citizens.
Responding to inquiries from local news media, representatives for ShinyHunters confirmed that the individual heard in the released audio clip is indeed an active member of their hacker collective. In a public statement shared with the NL Times, the group vowed unwavering support for their detained associate.
"Our team member has our full support—emotionally, mentally, and financially," the hackers stated. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
The collective also directed harsh criticism at Dutch law enforcement. "The Dutch police will need all the luck in the world—and everyone’s prayers—if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement read, adding derogatory remarks regarding the capabilities of the investigating agencies. Despite these threats, the Dutch police unit leading the Odido investigation has declined to comment on whether they have officially linked the recorded voice to a confirmed real-world identity.
FBI and Cl0p Hacks
The arrest of van der Stap proved to be a critical turning point, unleashing a wave of aggressive cyber operations. Just days after sources confirmed his detention, ShinyHunters claimed responsibility for an unusually sophisticated and high-profile breach targeting the FBI’s recruitment portal, apply.fbijobs.gov. Reporting from 404 Media revealed that the compromised data included Social Security numbers and detailed personal information belonging to more than 5,000 Bureau officials and applicants.
Documents reviewed by Reuters and 404 Media indicated that the stolen records contained sensitive employment classifications, detailing specific job titles and operational divisions such as special agents, threat intake examiners, members of major cybercrime units, and personnel tasked with investigating foreign state-sponsored cyber threats. Furthermore, investigative findings showed that the breach exposed confidential medical and psychological files pertaining to FBI personnel. The Bureau subsequently issued a brief public statement confirming the unauthorized compromise of the job portal.
According to technical analyses, ShinyHunters gained initial access to the FBI portal and numerous other corporate systems by exploiting a critical zero-day vulnerability, tracked as CVE-2026-35273, affecting Oracle PeopleSoft. PeopleSoft is a widely utilized enterprise software-as-a-service platform relied upon by global organizations for human resources, payroll, recruitment, and benefits management. Oracle moved quickly to issue security patches after the vulnerability began seeing active exploitation in June, while security firm Mandiant released defensive web application firewall (WAF) rules to assist organizations unable to immediately apply the official update.
However, security researchers at BleepingComputer reported that ShinyHunters subsequently deployed a URL-encoding evasion technique to bypass Mandiant’s mitigation rules. In a joint threat intelligence report published on September 25, experts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had executed a mass-exploitation campaign leveraging the PeopleSoft flaw, compromising dozens of systems across diverse critical sectors, including government agencies, higher education, healthcare, technology, agriculture, and transportation.
Intriguingly, van der Stap’s former hacker alias, "Umbreon," appeared directly within the digital footprints left behind by the hackers. The defacement screen uploaded by ShinyHunters to the compromised FBI jobs portal featured an ASCII art graphic of the Pokémon character Umbreon, accompanied by the text: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Security analysts noted that the imagery was identical to a defacement banner deployed by the group during their 2020 compromise of the English-language cybercrime forum Hackforums.
Security sources close to the ongoing international investigation indicated that the group’s recent, highly risky attacks against both the FBI and Cl0p—one of Russia’s most entrenched ransomware syndicates—represent a stark departure from the more calculated and restrained operational style the gang previously maintained. Analysts attribute this sudden strategic pivot to a leadership transition within ShinyHunters, which was reportedly taken over by a teenage cybercriminal from Amman, Jordan. Operating under the alias "Rey," this individual is a key figure in ScatteredLapsussHunters (SLSH), a hybrid cybercrime consortium formed by the merger of three notorious hacking factions: Scattered Spider, LAPSUS$, and ShinyHunters.
According to insider accounts, Rey harbored a persistent rivalry with the Dutch hacker regarding control over the ShinyHunters brand and its repository of stolen data. Investigators suggest that the prominent inclusion of the Umbreon graphic in the FBI portal defacement was a deliberate tactical move by Rey to implicate van der Stap and deflect scrutiny.
Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Ahead of a subsequent journalistic profile published in late 2025, researchers contacted Rey’s father to request an interview with the teenager. Rather than intervening, the father forwarded the communication directly to his son, who subsequently admitted to participating in ransomware campaigns while expressing a desire to distance himself from the SLSH collective.
Blaming Umbreon
Following widespread media coverage of the FBI portal intrusion, Rey utilized a primary social media account on X (formerly Twitter) under the handle @rmoskovy to mock both the FBI and the Cl0p ransomware group. One widely circulated post featured a crude meme depicting the World Trade Center towers being struck by aircraft labeled "cl0p drama" and "fbi breach claim," with a giant, float-sized rendering of the Pokémon character Umbreon looming in the foreground.
On September 24, reporters again attempted to reach Rey and his father for comment regarding Rey’s reported ascent to leadership within ShinyHunters. Within hours of the outreach inquiry, the X account associated with Rey was permanently deleted. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, failed to respond to multiple emailed requests for comment concerning his son’s alleged illicit activities.
The underlying hostility between the SLSH faction and core members of ShinyHunters stems from a short-lived operational partnership earlier in the year. According to an extensive investigative report published by Wired, the groups briefly joined forces to better monetize stolen credentials gathered by TeamPCP, an emerging cybercrime cell specializing in compromising global software supply chains. Despite successfully breaching numerous corporate code repositories, TeamPCP had struggled to convert their stolen data into substantial financial gains, with alleged leaders later claiming they netted a mere $20,000 before their arrest in Australia.
In reality, Mandiant analysts had secretly infiltrated TeamPCP’s infrastructure, rapidly burning the stolen credentials by funneling them to major cloud infrastructure providers like Amazon and Microsoft, who systematically invalidated the compromised API keys and session tokens. As the operation unraveled, the cooperating hacker factions began trading accusations over who was responsible for rendering the credentials worthless.
According to Wired reporter Andy Greenberg, ShinyHunters ultimately went rogue, executing independent extortion demands using TeamPCP’s stolen credentials without sharing any proceeds with the supply-chain hackers. Mandiant researcher Austin Larsen noted that ShinyHunters has maintained an exceptionally lucrative extortion spree throughout the year, putting the collective on track to amass nearly $100 million in extortion payouts from corporate victims by the close of 2026.
For his part, van der Stap consistently maintained during past interviews that financial enrichment was never his primary motivation. Instead, he claimed his early cybercrime activities were driven by an obsessive compulsion to compile the world’s most comprehensive repository of stolen databases. In a 2024 interview with Bloomberg, van der Stap reflected on his psychological drive: "The hacking was very easy for me, and it wasn’t a compulsion. My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap previously volunteered, announced via LinkedIn that the organization was managing an internal cybersecurity incident involving the suspected malicious application of artificial intelligence. While DIVD released limited technical specifics regarding the breach, a spokesperson confirmed that the incident bore no connection to ShinyHunters, nor were there any indications that the matter involved the past actions of a former volunteer.
Dutch police formally confirmed the arrest of the 24-year-old suspect in connection with the ongoing ShinyHunters investigation. In a public statement issued via social media, law enforcement announced that the accused man is scheduled to appear before the chambers of the Rotterdam District Court, with authorities promising further updates as the inquiry progresses.
Adding to the gravity of the case, Dutch news outlet RTL reported that investigators are probing whether van der Stap attempted to orchestrate at least two murders overseas, with initial indications suggesting that the suspect may have issued orders to carry out the planned hits outside the Netherlands.
In Washington, the FBI released a video statement addressing the international crackdown on ShinyHunters. Brett Leatherman, assistant director of the FBI’s cyber division, thanked Dutch law enforcement partners for their critical collaboration and issued a direct warning to the remaining members of the hacking collective.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
