Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions carried out by the prolific hacker collective known as ShinyHunters. The detention of the suspect, which took place in mid-September, has triggered a dramatic and volatile escalation within the global cybercrime underworld. In the immediate aftermath of the arrest, remaining members of ShinyHunters launched a series of aggressive retaliatory operations, including a brazen breach of the Federal Bureau of Investigation’s recruitment portal and the direct extortion of the notorious Russian ransomware syndicate Cl0p.
According to three independent sources familiar with the ongoing international investigation, the suspect taken into custody by Dutch law enforcement is Pepijn van der Stap, a convicted cybercriminal originally from Almere and Lelystad in the Netherlands. Van der Stap was previously convicted in late 2023 for his involvement in an extensive string of data thefts and digital extortions. Prosecutors in that earlier case estimated that his illicit operations had generated between €1.5 million and €2.7 million in criminal proceeds.
During his 2023 trial, van der Stap admitted to living a paradoxical "Dr. Jekyll and Mr. Hyde" existence. By night, he secretly operated under the hacker handle "Umbreon"—named after the fictional Pokémon character—using English-language underground hacking forums like the now-defunct RaidForums and Breached to extort victims and publish sensitive corporate databases. By day, however, van der Stap maintained a completely legitimate professional life. He worked as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, and volunteered his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization dedicated to identifying and resolving digital vulnerabilities.
Van der Stap fully confessed to his extensive data theft and extortion activities during court proceedings and was subsequently sentenced to four years in prison, with one year suspended. In a somewhat unusual move during his trial, van der Stap requested to remain in custody rather than return home, stating that he could not find adequate outside treatment for his ongoing psychological struggles, which he attributed to post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a completely reformed individual striving to turn his life around and make constructive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to requests for comment from journalists.
During that same conversation, van der Stap noted that he was still actively dealing with lingering civil lawsuits and financial restitution requirements related to his past cybercrimes, emphasizing that he was doing his best to make amends. However, shortly after that interview concluded, van der Stap abruptly ceased responding to communications. Efforts by acquaintances and associates to reach him repeatedly failed over the following two weeks.
According to two sources with direct knowledge of the situation, Dutch authorities arrested van der Stap on or around September 16, subsequently holding him in secure custody for intensive questioning. One source reported that a colleague personally witnessed law enforcement officers carrying various items and electronic equipment out of van der Stap’s residence during the raid.
The arrest coincides with an intensive public appeal by Dutch law enforcement. Earlier in September, authorities released a recorded telephone call from February 2026, asking the public for assistance in identifying a native Dutch speaker who successfully social-engineered their way into Odido, the Netherlands’ largest mobile telecommunications provider. During that intrusion, the ShinyHunters operative tricked an Odido employee into authenticating their credentials on a spoofed website, leveraging that unauthorized access to steal personal data belonging to more than 6.2 million Dutch citizens.
Responding to inquiries from local news media, ShinyHunters publicly confirmed that the suspect heard in the police audio clip is indeed a member of their hacking collective. In a defiant statement shared with the NL Times, the group vowed unconditional support for their arrested comrade.
"Our team member has our full support—emotionally, mentally, and financially," the hackers stated. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
The collective also lashed out directly at Dutch law enforcement agencies. "The Dutch police will need all the luck in the world—and everyone’s prayers—if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement read. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
The Dutch police subsequently confirmed the arrest of a 24-year-old individual in connection with the ongoing ShinyHunters investigation. In a statement posted to social media, law enforcement announced that the suspect would appear before the chambers of the Rotterdam District Court. Furthermore, investigative reports from the Dutch news outlet RTL revealed that authorities are also probing whether van der Stap attempted to orchestrate at least two murders abroad, with investigators uncovering indications that the suspect may have issued orders for the killings.
FBI, CL0P HACKS
Just days after van der Stap was detained by authorities, ShinyHunters claimed responsibility for an unusually brazen and high-profile cyberattack targeting the FBI’s job application portal, apply.fbijobs.gov. According to reporting by 404 Media, the data exfiltrated during this breach included Social Security numbers and sensitive personal information belonging to more than 5,000 bureau officials and applicants.
Both 404 Media and Reuters reported that the compromised FBI records contained specific job titles and operational team assignments, identifying personnel working within major cybercrimes units, threat intake examination desks, and divisions tasked with investigating state-sponsored foreign cyber threats. Furthermore, documents examined by Reuters indicated that the stolen files included confidential psychiatric and medical records of bureau personnel. The FBI issued a brief press statement formally acknowledging the compromise of the portal and the resulting impact on employee personally identifiable information.
According to ShinyHunters, access to the FBI portal and other victim systems was achieved by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft—a widely used enterprise software-as-a-service platform from Oracle utilized globally for human resources, recruitment, benefits administration, and payroll management. Oracle swiftly released security patches for the PeopleSoft vulnerability after discovering that ShinyHunters had been actively exploiting the flaw as a zero-day since June. In response, Mandiant had previously released web application firewall (WAF) rules designed to protect organizations that could not immediately apply the software updates.
However, subsequent technical disclosures revealed that ShinyHunters managed to circumvent Mandiant’s mitigation rules by employing a URL-encoding trick. In a joint threat intelligence report published by Mandiant and the Google Threat Intelligence Group, security experts confirmed that ShinyHunters had executed a mass-exploitation campaign targeting the PeopleSoft vulnerability across dozens of organizations spanning diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.
Intriguingly, van der Stap’s former hacker alias, Umbreon, was hidden in plain sight within the visual artifacts left behind by ShinyHunters during the FBI portal breach. The defacement image posted on the hacked recruitment site featured an ASCII art rendering of the Pokémon character Umbreon alongside a taunting message declaring that the site had been seized by the hacking collective. The imagery appeared identical to a defacement banner previously utilized by ShinyHunters during their 2020 compromise of the English-language cybercrime community Hackforums.
Sources close to the investigation into ShinyHunters noted that these aggressive and risky operations against both the FBI and Cl0p—one of Russia’s most established ransomware syndicates—marked a sharp departure from the group’s historical operational style. This sudden strategic pivot reportedly followed a leadership shift within ShinyHunters, which fell under the control of a teenage cybercriminal from Amman, Jordan. Known by the online moniker "Rey," this individual operates as a prominent figure within ScatteredLapsussHunters, a hybrid cybercrime organization formed through the amalgamation of three notorious hacking groups: Scattered Spider, LAPSUS$, and ShinyHunters.
Investigators suggest that Rey harbored a lingering personal grievance against van der Stap regarding control over the ShinyHunters brand and accumulated data. Consequently, the prominent inclusion of the oversized Umbreon imagery in the FBI site defacement was interpreted by security analysts as a deliberate attempt by Rey to implicate the imprisoned Dutch hacker in the high-profile attack.
Rey was first publicly unmasked by the cybersecurity firm KELA in March 2025. Prior to publishing a detailed profile on the young administrator, security researchers contacted Rey’s father, who simply forwarded the communication to his son. Rey subsequently admitted to participating in ransomware activities while expressing a desire to distance himself from the hybrid hacking collective.
Immediately following the media coverage of the FBI portal breach, Rey’s primary social media account on X (formerly Twitter) was used to mock both the FBI and the Cl0p ransomware group. The posts featured satirical imagery depicting the entities as prominent structures struck by digital disruptions, framed by a giant floating figure of the Pokémon character Umbreon. Shortly after media inquiries were directed to his family regarding his alleged leadership role in ShinyHunters, Rey deactivated his social media accounts, while his father, an employee of Royal Jordanian Airlines, declined to respond to repeated requests for comment.
The underlying friction between the hybrid faction and ShinyHunters traces back to earlier operational partnerships. According to an investigative report published by Wired, members of ShinyHunters and the hybrid collective had briefly collaborated earlier in the year to monetize stolen credentials harvested by TeamPCP. TeamPCP was an upstart hacking group that specialized in compromising global software supply chains with malicious code but lacked effective mechanisms to monetize the vast amounts of stolen data they accumulated.
Although two alleged leaders of TeamPCP were arrested in Australia, investigative reports revealed that Mandiant had covertly infiltrated the group. Mandiant was secretly responsible for burning the stolen credentials by rapidly feeding them to major cloud providers such as Amazon and Microsoft, which promptly invalidated the keys before the hackers could leverage them. As the operation collapsed, the cooperating cybercrime factions began trading blame for the security interventions that rendered their stolen data worthless.
According to Wired, shortly after partnering with TeamPCP, ShinyHunters went rogue by executing independent extortions using the compromised supply-chain credentials without sharing the proceeds with their partners. Security researchers from Mandiant noted that ShinyHunters has enjoyed a remarkably lucrative extortion campaign throughout the year, putting the collective on track to amass nearly $100 million in extortion payments from victims globally.
Despite his extensive criminal history, van der Stap previously maintained that his primary motivation was never financial gain. In earlier interviews, he described his cyberattacks as driven by an obsessive compulsion to curate the world’s most comprehensive repository of stolen databases.
"The hacking was very easy for me, and it wasn’t a compulsion," van der Stap told Bloomberg in 2024. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the DIVD, the nonprofit security research organization where van der Stap previously volunteered, reported an internal cybersecurity incident involving the suspected malicious application of artificial intelligence. While the organization disclosed few specifics regarding the breach, a DIVD spokesperson confirmed that the incident appeared entirely unrelated to ShinyHunters and showed no connection to the work of any former volunteers.
In the wake of these developments, the international law enforcement response has intensified. Brett Leatherman, assistant director of the FBI’s cyber division, released a video message addressing the ongoing investigation into ShinyHunters. Leatherman thanked Dutch law enforcement partners for their crucial assistance and issued a direct warning to the remaining members of the hacking collective.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
