Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and extortion campaigns orchestrated by the prolific and aggressive hacker collective known as ShinyHunters. The high-stakes arrest has immediately triggered a volatile reaction within the cybercrime underworld, prompting remaining members of the group to dramatically escalate their operations. In the wake of the detention, ShinyHunters carried out a brazen data breach targeting the Federal Bureau of Investigation (FBI) and launched extortion tactics against the notorious Russian ransomware syndicate Cl0p.
According to three sources familiar with the matter, the individual taken into custody by Dutch law enforcement this month is Pepijn van der Stap, a convicted cybercriminal originally from Almere and Lelystad in the Netherlands. Van der Stap previously stood trial and was convicted in late 2023 for his involvement in an extensive string of data thefts and extortion schemes. At the time, Dutch prosecutors estimated that his illicit operations generated between €1.5 million and €2.7 million in criminal proceeds.
During his late 2023 trial, van der Stap admitted to living a paradoxical "Dr. Jekyll and Mr. Hyde" existence. By night, he secretly operated under the hacker handle "Umbreon," using English-language cybercrime forums such as the now-defunct RaidForums and Breached to extort victims and publish stolen databases. By day, however, van der Stap maintained a conventional and respectable professional profile, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a prominent nonprofit security research organization.
Van der Stap confessed openly to his illicit data theft and extortion activities during legal proceedings, resulting in a four-year prison sentence, of which one year was suspended. Seeking treatment for ongoing psychological challenges, including post-traumatic stress disorder stemming from childhood trauma, van der Stap initially chose to remain in custody rather than serve time under home detention, asserting that he would receive better support behind bars. He was ultimately released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a completely reformed individual dedicated to turning his life around and contributing positively to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that has thus far declined to respond to media requests for comment.
During that same conversation, van der Stap noted that he was still navigating complex civil lawsuits and restitution requirements tied to the victims of his past cybercrimes, emphasizing that he was doing his utmost to make amends. Shortly after the interview concluded, however, van der Stap abruptly ceased all communication, failing to respond to messages from journalists and close associates alike over a two-week period.
According to two sources with direct knowledge of the situation, van der Stap was arrested by Dutch law enforcement on or around September 16 and has remained in custody for interrogation. One source reported that a colleague personally witnessed police officers removing numerous items from van der Stap’s residence during the raid.
For months, Dutch authorities have been actively pursuing leads in connection with the ShinyHunters collective, publicly appealing to citizens for help in identifying the voice featured in a recorded phone call from February 2026. In that audio, a native Dutch-speaking member of ShinyHunters successfully employed social engineering tactics to breach Odido, the largest mobile telecommunications provider in the Netherlands. Posing as an authorized individual, the caller tricked an Odido employee into authenticating credentials at a spoofed website, giving the hackers unauthorized access to sensitive records belonging to more than 6.2 million Dutch citizens.
In statements to local media, ShinyHunters confirmed that the individual heard in the released audio recording is indeed a member of their hacking collective. Emphasizing solidarity, the group released a public statement declaring that their detained teammate has their full emotional, mental, and financial backing, noting that they had already arranged for professional legal defense representation. The group also expressed blatant contempt for local law enforcement agencies, dismissing the capabilities of the Dutch police in strongly worded statements.
FBI and Cl0p Hacks
The security landscape shifted dramatically just days after sources indicated van der Stap had been detained. ShinyHunters stepped forward to claim responsibility for a highly sensitive breach affecting the FBI’s job application portal at apply.fbijobs.gov. Reporting from outlets including 404 Media and Reuters revealed that the stolen data comprised sensitive personal identifiable information, including Social Security numbers and background details belonging to more than 5,000 bureau personnel.
The compromised records detailed specific job titles and operational divisions, ranging from special agents and threat intake examiners to members of major cybercrime units and teams dedicated to investigating foreign state-backed cyber threats. Furthermore, Reuters examined sample documents provided by the hackers and confirmed they included confidential psychiatric and medical records of FBI employees. The bureau subsequently issued a formal statement acknowledging the compromise of the recruitment portal.
According to threat intelligence analysts, the group breached the FBI portal and various other corporate systems by exploiting a recently patched vulnerability, cataloged as CVE-2026-35273, affecting PeopleSoft—an enterprise software platform developed by Oracle and widely utilized for recruitment, payroll, and human resources management. While Oracle quickly deployed a security patch after the flaw was targeted as a zero-day exploit in June, security firms such as Mandiant initially issued web application firewall (WAF) rules to assist organizations unable to immediately apply the software update.
However, security researchers at BleepingComputer and the Google Threat Intelligence Group (GTIG) reported that ShinyHunters successfully bypassed Mandiant’s mitigation rules by employing a URL-encoding technique. In a joint threat intelligence report, Mandiant and GTIG confirmed that the collective utilized this mass-exploitation campaign to infiltrate dozens of networks across diverse sectors, including technology, healthcare, transportation, agriculture, higher education, and government entities.
Intriguingly, van der Stap’s former hacker handle, Umbreon, appeared unmistakably within the digital footprint left behind during the FBI portal breach. The defacement message posted on the compromised recruitment site featured an ASCII art rendering of the Pokémon character Umbreon alongside a taunting banner declaring that the site had been seized by ShinyHunters. Security analysts noted that the visual composition was nearly identical to a defacement banner deployed by the group during its 2020 infiltration of the English-language cybercrime forum Hackforums.
Sources close to the ongoing investigation indicate that these high-risk operations against both the FBI and Cl0p—one of Russia’s most established ransomware syndicates—represent a significant tactical pivot for ShinyHunters. This sudden escalation reportedly followed a leadership shift within the group, which fell under the control of a teenage cybercriminal based in Amman, Jordan. Operating under the alias "Rey," this individual is a prominent figure within ScatteredLapsussHunters (SLSH), a hybrid cybercrime consortium formed by the merger of three notorious hacking factions: Scattered Spider, LAPSUS$, and ShinyHunters.
Investigators suggest that Rey harbored a long-standing personal and operational feud with van der Stap over control of the ShinyHunters brand and its vast repository of stolen data. Consequently, security experts believe the prominent inclusion of the Umbreon artwork on the defaced FBI portal was an intentional maneuver by Rey to cast suspicion and pin the high-profile attack back onto the imprisoned Dutch hacker.
Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. During prior journalistic inquiries, including a profile conducted by KrebsOnSecurity, journalists reached out to Rey’s family, resulting in the teenager acknowledging his participation in various ransomware and extortion campaigns while expressing a desire to distance himself from the SLSH collective. Following news of the FBI portal breach, Rey’s primary social media account on X published taunting memes directed at both the FBI and Cl0p before the profile was abruptly deleted. Requests for comment sent to Rey’s father, an employee of Royal Jordanian Airlines, went unanswered.
The underlying friction between SLSH and ShinyHunters stems from previous brief alliances aimed at monetizing stolen corporate credentials. Investigative reports by media outlets like Wired revealed that both groups had partnered earlier in the year with TeamPCP, an upstart supply-chain hacking faction that successfully compromised software supply chains but struggled to generate significant financial returns from their harvested data.
While Mandiant operatives secretly infiltrated TeamPCP and neutralized compromised credentials by feeding them to major cloud providers such as Amazon and Microsoft, the cooperating cybercrime factions quickly turned on one another, each blaming the other for the invalidated access keys. According to security analysts, ShinyHunters ultimately went rogue, executing independent extortion operations utilizing the stolen credentials without sharing profits with their partners. Despite these internal conflicts, security researchers estimate that ShinyHunters is on track to amass nearly $100 million in extortion payments throughout 2026.
In contrast to financially driven syndicates, van der Stap historically maintained that his primary motivation was not monetary gain. In prior interviews with media organizations such as Bloomberg, he described his criminal activities as an obsessive compulsion to collect, organize, and archive stolen databases rather than an aggressive pursuit of profit.
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap formerly volunteered, announced that it had recently managed an internal security incident involving the malicious application of artificial intelligence tools. While the nonprofit released limited details regarding the event, representatives confirmed that the occurrence bore no connection to ShinyHunters or the past activities of their former volunteer.
Dutch police formally confirmed the detention of the 24-year-old suspect in connection with the ongoing ShinyHunters investigation, announcing that he would appear before the Rotterdam District Court. Meanwhile, international law enforcement partners continue to assess the fallout from the coordinated campaigns.
In a public video statement released by the FBI, Brett Leatherman, assistant director of the bureau’s cyber division, thanked Dutch authorities for their crucial assistance and delivered a direct warning to remaining members of the ShinyHunters collective.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
