Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions carried out by the prolific and aggressive hacker group ShinyHunters. The high-profile arrest has sent immediate shockwaves through the underground cybercrime ecosystem. In the days immediately following the suspect’s detention, remaining members of the ShinyHunters collective dramatically escalated their operations, launching a wave of retaliatory actions that included stealing highly sensitive data from the Federal Bureau of Investigation (FBI) and extorting the notorious Russian ransomware syndicate Cl0p.
According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a previously convicted cybercriminal who operated out of Almere and Lelystad in the Netherlands. Van der Stap was first convicted in 2023 for his involvement in a sweeping series of corporate data thefts and corporate extortions. Dutch prosecutors at the time estimated that his illicit digital operations had generated between €1.5 million and €2.7 million in illegal proceeds.
During his late 2023 criminal trial, van der Stap offered a candid admission of his dual existence, describing a Dr. Jekyll and Mr. Hyde lifestyle. By night, he secretly utilized the hacker handle “Umbreon”—inspired by the Pokémon character of the same name—to extort corporate victims and publish stolen databases on prominent English-language cybercrime forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a completely respectable professional front, working as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also dedicated his time as a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization.
Van der Stap fully confessed to his extensive data theft and extortion activities during court proceedings. Consequently, the Dutch court sentenced him to four years in prison, with one year suspended. During the legal process, van der Stap made the unusual choice to remain in custody rather than return home while awaiting certain phases of his detention, explaining to the court that he could not find adequate medical or psychological treatment on the outside for his ongoing mental health struggles, which he claimed included post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap cast himself as a thoroughly reformed individual striving to turn his life around and make meaningful, positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to multiple media requests for comment regarding the arrest.
During that same conversation, van der Stap mentioned that he was still actively dealing with civil lawsuits, legal fallout, and financial restitution demands tied to his past cybercrime victims, asserting that he was doing his absolute best to make amends. However, shortly after that media interview concluded, the Dutch hacker abruptly ceased replying to electronic messages. Efforts by acquaintances and associates to reach him repeatedly failed over the subsequent two weeks.
According to two independent sources with direct knowledge of the investigation, van der Stap was arrested by Dutch law enforcement officers on or around September 16 and has been held in custody for intensive questioning ever since. One source noted that a colleague personally witnessed Dutch authorities carting physical items, computer hardware, and documents out of van der Stap’s residential property.
Law enforcement agencies across the Netherlands have spent months aggressively hunting down individuals linked to the ShinyHunters collective. Earlier in September, Dutch police publicly appealed for public assistance in identifying a native Dutch-speaking member of the group whose voice was captured in a recorded telephone call from February 2026. During that call, the suspect successfully social-engineered their way into Odido, the nation’s largest mobile telecommunications provider. The audacious intrusion tricked an Odido employee into logging into a spoofed, attacker-controlled website, granting the hackers unauthorized access to steal personal data belonging to more than 6.2 million Dutch citizens.
Responding directly to inquiries from Dutch news media outlets, representatives for ShinyHunters confirmed that the individual heard in the released audio clip is indeed an active member of their hacker collective.
"Our team member has our full support – emotionally, mentally, and financially," the hackers stated in a message shared with the NL Times. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
At the same time, the collective launched verbal tirades against European law enforcement. "The Dutch police will need all the luck in the world – and everyone’s prayers – if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement read. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
FBI and CL0P Hacks
Just days after sources confirmed van der Stap’s detention by Dutch authorities, ShinyHunters claimed responsibility for an unusually brazen and damaging breach targeting the FBI’s job application portal at apply.fbijobs.gov. Reporting from cybersecurity media outlet 404 Media revealed that the data compromised in the attack included Social Security numbers and deeply personal information belonging to more than 5,000 bureau officials and applicants.
Both 404 Media and Reuters reported that the compromised FBI personnel records detailed specific job titles and sensitive operational assignments. These included positions within special agent ranks, threat intake examiners, major cybercrimes units, and teams dedicated to investigating complex cyber threats originating from foreign state-backed actors. Furthermore, Reuters examined documentation shared by the hackers and confirmed it contained sensitive psychiatric and medical files belonging to FBI personnel. The bureau subsequently issued a brief public statement confirming the compromise of the employment portal.
According to ShinyHunters, the group gained unauthorized entry into the FBI recruitment platform and other corporate systems by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widely used software-as-a-service platform developed by technology giant Oracle, heavily relied upon globally by enterprises and government agencies to manage human resources, recruitment, employee benefits, and payroll systems. Oracle swiftly released a security update to address the flaw after discovering that ShinyHunters had begun actively exploiting it as a zero-day vulnerability as early as June. Concurrently, security firm Mandiant released web application firewall (WAF) mitigation rules for organizations unable to apply the official patch immediately.
However, subsequent reports from BleepingComputer indicated that ShinyHunters managed to bypass Mandiant’s recommended WAF defensive rules by deploying clever URL-encoding tricks. In a joint threat intelligence report released on September 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters executed a mass-exploitation campaign targeting the PeopleSoft flaw, successfully extracting data from dozens of enterprise systems spanning multiple industries, including higher education, technology, healthcare, agriculture, transportation, and government sectors.
Significantly, van der Stap’s former hacker alias, Umbreon, remained hidden in plain sight across the visual assets utilized by ShinyHunters to publicize the FBI breach. The digital defacement banner left behind on the compromised FBI jobs portal featured prominent ASCII art depicting the Pokémon character Umbreon. A message printed at the top declared, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Security analysts noted that the visual layout was nearly identical to a defacement message previously deployed by ShinyHunters during their 2020 intrusion into the English-language cybercrime community HackForums.
Multiple sources close to the unfolding international investigation indicated that the group’s high-risk, provocative attacks against both the FBI and Cl0p—one of Russia’s most established ransomware organizations—represented a dramatic strategic pivot away from the gang’s historically more measured operational style. Analysts noted that this sudden shift coincided with an internal leadership transition within ShinyHunters, which had reportedly fallen under the control of a teenage cybercriminal based in Amman, Jordan. Operating under the online moniker "Rey," this individual is a key figure in ScatteredLapsussHunters (SLSH), a hybrid cybercrime consortium formed by the merger of three notorious hacking factions: Scattered Spider, LAPSUS$, and ShinyHunters.
According to insider accounts, Rey harbored a lingering personal and professional feud with van der Stap regarding operational control over the ShinyHunters brand and its amassed data repositories. Investigators believe that integrating the oversized Umbreon Pokémon imagery into the FBI job site defacement was a deliberate attempt by Rey to frame the imprisoned Dutch hacker for the high-profile attack.
Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Ahead of a subsequent investigative profile published by KrebsOnSecurity in November 2025, reporters contacted Rey’s father to request an interview with the teenager. Rather than intervening, the father forwarded the message directly to his son, who readily admitted to participating in past ransomware operations while claiming he was attempting to distance himself from the SLSH collective.
Blaming Umbreon
Immediately after mainstream media outlets picked up reports of the FBI recruitment portal breach, Rey’s primary social media account on X (formerly Twitter) began aggressively taunting both the Cl0p ransomware gang and federal investigators. One posted meme crudely depicted the groups as the twin towers of New York being struck by aircraft labeled "cl0p drama" and "fbi breach claim," with a giant, float-sized rendering of the Pokémon character Umbreon towering in the foreground of the city skyline.
On September 24, reporters again attempted to contact Rey’s father to secure an interview regarding his son’s apparent rise to leadership within ShinyHunters. Just hours after that outreach, Rey abruptly deleted his longstanding X account. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, ceased responding to subsequent email inquiries concerning his son’s alleged digital activities.
The underlying animosity between the SLSH faction and core members of ShinyHunters stems from previous operational disputes. Earlier in the year, as detailed in an investigative report by Wired, members of ShinyHunters and SLSH briefly partnered to better monetize valuable stolen credentials gathered by TeamPCP. TeamPCP was an upstart hacking cell that specialized in compromising global software code supply chains with malicious packages, though its members had struggled to turn their stolen access into substantial financial gains—with two alleged leaders subsequently arrested in Australia after netting a mere $20,000 from their efforts.
As Wired reported, security firm Mandiant had covertly infiltrated TeamPCP and was secretly responsible for burning the group’s stolen corporate credentials by quietly funneling them to major cloud infrastructure providers like Amazon and Microsoft, which promptly invalidated the keys. This interference caused intense paranoia and finger-pointing among the allied hacker cells, with each group blaming the others for rendering the stolen access worthless.
According to Wired reporter Andy Greenberg, weeks after partnering with TeamPCP, ShinyHunters went rogue, independently executing corporate extortions using the shared credentials while cutting out their supply-chain partners. Mandiant researcher Austin Larsen noted that ShinyHunters enjoyed a highly lucrative extortion spree throughout the year, putting the collective on track to secure nearly $100 million in ransom and extortion payments by the end of 2026.
Despite participating in high-stakes extortion campaigns, van der Stap had previously insisted that financial enrichment was never his primary driver. In interviews following his 2024 court proceedings, he told Bloomberg that his digital crimes stemmed from an obsessive compulsion to build the world’s most comprehensive archive of stolen databases.
"The hacking was very easy for me, and it wasn’t a compulsion," van der Stap told Bloomberg. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap had previously volunteered, disclosed an internal cybersecurity incident involving the potential malicious application of artificial intelligence tools. While DIVD released few specifics regarding the event, a spokesperson for the nonprofit assured researchers that the breach bore no connection to ShinyHunters, nor was there any indication that van der Stap’s past volunteer work played a role.
Dutch police officially confirmed the arrest of a 24-year-old suspect in connection with the ongoing ShinyHunters investigation. In a public statement posted to social media, law enforcement announced that the detained individual would appear before the chambers of the Rotterdam District Court as the investigation progresses.
Concurrently, the FBI released a video message addressing the ShinyHunters case. Brett Leatherman, assistant director of the FBI’s cyber division, thanked Dutch law enforcement partners for their critical investigative assistance and directly warned the remaining members of the hacker collective.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
