{"id":1122,"date":"2026-10-09T22:51:26","date_gmt":"2026-10-09T22:51:26","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1122"},"modified":"2026-10-09T22:51:26","modified_gmt":"2026-10-09T22:51:26","slug":"dutch-arrest-of-convicted-cybercriminal-sparking-retaliatory-attacks-and-international-hacking-fallout","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1122","title":{"rendered":"Dutch Arrest of Convicted Cybercriminal Sparking Retaliatory Attacks and International Hacking Fallout"},"content":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-stakes data thefts and corporate extortions orchestrated by the prolific and aggressive hacker group known as ShinyHunters. The high-profile arrest has sent immediate shockwaves through the underground cybercrime ecosystem, triggering a dramatic and dangerous escalation in retaliatory operations by remaining ShinyHunters members, who quickly launched devastating attacks targeting the Federal Bureau of Investigation (FBI) and attempting to extort the notorious Russian ransomware syndicate Cl0p.<\/p>\n

According to three sources familiar with the matter, the Dutch national taken into custody by law enforcement this month is Pepijn van der Stap, a previously convicted cybercriminal residing in Almere and Lelystad in the Netherlands. Van der Stap\u2019s notoriety in the cybersecurity community stems from a 2023 conviction connected to an extensive spree of corporate data thefts and aggressive extortions. At the time, Dutch prosecutors estimated that his illicit operations generated between \u20ac1.5 million and \u20ac2.7 million in illicit proceeds.<\/p>\n

During his trial in late 2023, van der Stap candidly admitted to maintaining a starkly contrasting lifestyle, operating under the clandestine hacker moniker "Umbreon." While maintaining his secret persona to extort vulnerable corporate victims and publish stolen databases on English-language cybercrime forums like the now-defunct RaidForums and Breached, van der Stap maintained a respectable day job. By day, he worked as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering his time with the Dutch Institute for Vulnerability Disclosure (DIVD), a prominent nonprofit security research organization dedicated to finding and resolving software vulnerabilities.<\/p>\n

Van der Stap confessed openly to his involvement in data theft and extortion schemes during legal proceedings, resulting in a four-year prison sentence, of which one year was suspended. During the trial proceedings, van der Stap elected to remain in custody rather than returning home, citing his need for specialized treatment for ongoing psychological challenges, including post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.<\/p>\n

In an interview conducted with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a completely reformed individual who was actively working to turn his life around and make positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that declined to respond to media requests for comment regarding his arrest.<\/p>\n

During the interview, van der Stap noted that he was still navigating complex civil lawsuits and mandated financial restitution tied to his past cybercrime offenses, insisting he was doing his absolute best to make amends. However, shortly after that conversation concluded, the Dutch hacker abruptly ceased responding to electronic messages. Efforts by acquaintances and associates to establish contact repeatedly failed over the subsequent two weeks.<\/p>\n

According to two sources with direct knowledge of the unfolding situation, Dutch law enforcement officers detained van der Stap on or around September 16, placing him in custody for continuous questioning. One source reported that a colleague personally witnessed police officers removing numerous items and electronic equipment from van der Stap’s residential property.<\/p>\n

Law enforcement agencies across the Netherlands have spent recent months actively seeking public assistance in identifying a voice recorded during a telephone call from February 2026. In that intercepted communication, a native Dutch-speaking operative associated with ShinyHunters successfully social-engineered their way into Odido, the nation\u2019s largest mobile telecommunications provider. Through the deception, the hackers tricked an Odido employee into authenticating credentials on a spoofed phishing website, granting the threat actors unauthorized access to steal sensitive personal data belonging to more than 6.2 million Dutch citizens.<\/p>\n

\"Dutch<\/figure>\n

When questioned by Dutch media outlets, representatives for ShinyHunters readily confirmed that the individual heard in the released audio recording is indeed an active member of their collective. In a public statement shared with the NL Times, the group expressed unwavering solidarity with their detained associate. <\/p>\n

"Our team member has our full support \u2013 emotionally, mentally, and financially," the hackers declared in their statement. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."<\/p>\n

The syndicate also issued harsh criticisms directed squarely at Dutch law enforcement authorities. "The Dutch police will need all the luck in the world \u2013 and everyone\u2019s prayers \u2013 if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement warned. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."<\/p>\n

It remains unclear whether Dutch investigators have successfully linked the voice from the Odido intrusion to a verified legal identity outside of the ongoing inquiries. The specific police unit managing the Odido investigation declined to provide comments to inquiring journalists.<\/p>\n

FBI and Cl0p Hacks<\/h2>\n

Just days after sources confirmed van der Stap\u2019s detention by Dutch authorities, ShinyHunters claimed responsibility for an extraordinarily brazen breach targeting the FBI\u2019s job application portal, apply.fbijobs.gov. Reporting from specialized technology publication 404 Media revealed that the stolen records included Social Security numbers and deeply sensitive personal information belonging to more than 5,000 bureau personnel.<\/p>\n

Investigations by 404 Media and Reuters determined that the compromised data contained specific job titles and operational team assignments, identifying personnel working as special agents, threat intake examiners, and members of major cybercrimes units, including teams tasked with investigating state-sponsored cyber threats originating from foreign adversaries. Furthermore, Reuters reviewed documentation provided by the hackers confirming that the leak contained sensitive psychiatric and medical files belonging to FBI employees. In response to the breach, the bureau issued a brief public statement acknowledging the unauthorized compromise of its job portal.<\/p>\n

ShinyHunters asserted that they gained initial entry into the FBI website and numerous other victim networks by weaponizing a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widely utilized software-as-a-service platform developed by Oracle that helps organizations manage hiring, human resources, employee benefits, and payroll systems. Oracle moved swiftly to release a security update addressing the PeopleSoft flaw after discovering that ShinyHunters had begun weaponizing it as a zero-day exploit in June. Concurrently, cybersecurity firm Mandiant issued web application firewall (WAF) mitigation rules designed to protect organizations incapable of immediately applying the official software patch.<\/p>\n

However, security reporting from BleepingComputer exposed that ShinyHunters utilized a clever URL-encoding evasion technique to successfully bypass the WAF mitigation rules recommended by Mandiant. In a comprehensive threat intelligence report published on September 25, security researchers from Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters executed a mass-exploitation campaign leveraging the PeopleSoft vulnerability to infiltrate and extract data from dozens of distinct enterprise systems across diverse industries, including higher education, technology, healthcare, agriculture, transportation, and government sectors.<\/p>\n

\"Dutch<\/figure>\n

Van der Stap\u2019s former hacker moniker, Umbreon, was prominently displayed within the visual assets distributed by ShinyHunters to publicize their breach of the FBI. The digital defacement message left behind on the compromised FBI jobs portal featured an intricate ASCII art graphic depicting the Pok\u00e9mon character Umbreon alongside a bold caption stating, "This site has been seized by ShinyHunters. rooting your systems since \u201919 ;)." The graphic appeared identical to defacement imagery previously deployed by ShinyHunters during their 2000 breach of the English-language cybercrime community HackForums.<\/p>\n

Multiple sources close to the unfolding investigation into ShinyHunters noted that the group’s reckless and high-profile attacks against the FBI and one of Russia’s most entrenched ransomware syndicates represented a sharp departure from their traditional operational style. According to these sources, the abrupt tactical shift occurred following a leadership takeover within the collective orchestrated by a teenage cybercriminal based in Amman, Jordan. Operating under the alias "Rey," this individual acts as a core member of an amalgamated cybercrime entity known as ScatteredLapsussHunters (SLSH), which security analysts describe as a hybrid coalition formed by former members of Scattered Spider, LAPSUS$, and ShinyHunters.<\/p>\n

Sources indicated that Rey maintained a contentious rivalry with the Dutch hacker regarding ultimate control over the ShinyHunters brand identity and repository of stolen data. Consequently, security experts believe the prominent inclusion of the oversized Pok\u00e9mon graphic during the FBI portal defacement was a calculated maneuver by Rey to intentionally implicate the imprisoned Dutchman.<\/p>\n

Rey was first publicly identified by cybersecurity firm KELA in March 2025. Prior to publishing an extensive profile on the young hacker in November 2025, researchers contacted Rey’s father to request an interview with his teenage son. Rather than intervening, the father forwarded the inquiry directly to Rey, who openly acknowledged his participation in ransomware extortion schemes while expressing a desire to disengage from the SLSH collective.<\/p>\n

Blaming Umbreon<\/h2>\n

Immediately following widespread media coverage of the FBI job portal incident, Rey’s primary account on the social media platform X utilized aggressive taunts directed at both the Cl0p ransomware group and the FBI. One shared meme crudely depicted the organizations as the New York World Trade Center towers being struck by aircraft labeled "cl0p drama" and "fbi breach claim," with a giant cartoon float of the Pok\u00e9mon character Umbreon looming in the foreground.<\/p>\n

On September 24, investigators again contacted Rey’s father to request interviews regarding his son’s rising influence as the presumed leader of ShinyHunters. Just hours after that outreach, Rey permanently deleted his long-standing social media account. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, failed to respond to numerous email inquiries regarding his son’s alleged illicit activities.<\/p>\n

Underlying tensions between SLSH and ShinyHunters stem from brief operational partnerships established earlier in the year. According to reporting by Wired, members of ShinyHunters and SLSH briefly collaborated to monetize valuable corporate credentials harvested by TeamPCP, an emerging cybercriminal faction that successfully compromised global software supply chains but struggled to convert stolen access into financial gains. (Two alleged leaders of TeamPCP were arrested in Australia, with leadership subsequently claiming their enterprise generated a mere $20,000).<\/p>\n

Wired’s reporting detailed how Mandiant had covertly infiltrated TeamPCP’s infrastructure and orchestrated the rapid invalidation of stolen credentials by secretly feeding access keys directly to major cloud service providers such as Amazon and Microsoft. As the compromised credentials lost their value, the allied cybercrime factions began trading blame internally for the security failures.<\/p>\n

\"Dutch<\/figure>\n

Mandiant researcher Austin Larsen noted that ShinyHunters has experienced a remarkably lucrative extortion streak throughout the year, remaining on pace to accumulate nearly $100 million in extortion payments from corporate victims.<\/p>\n

Conversely, van der Stap consistently maintained that financial gain was never his primary motivation. He asserted that his historical hacking activities were driven primarily by an obsessive compulsion to curate the world\u2019s most comprehensive archive of stolen databases. Speaking with reporters from Bloomberg in 2024, van der Stap described his singular fixation.<\/p>\n

"The hacking was very easy for me, and it wasn\u2019t a compulsion," he stated. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."<\/p>\n

Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap previously served as an active volunteer, disclosed via LinkedIn that the organization was managing an internal security incident involving the malicious application of artificial intelligence. Although DIVD provided limited public details regarding the breach, a spokesperson confirmed to reporters that the internal incident appears entirely unrelated to ShinyHunters and bears no connection to the past contributions of any former volunteers.<\/p>\n

Dutch police formally confirmed the arrest of a 24-year-old individual tied directly to the ongoing ShinyHunters investigation. In a public statement shared on social media, law enforcement indicated that the suspect would appear before the Rotterdam District Court chambers to face judicial proceedings, with authorities promising additional updates regarding the case.<\/p>\n

Subsequent reporting from Dutch news outlet RTL revealed that investigators are probing suspicions that van der Stap attempted to orchestrate at least two contract murders directed to take place abroad, with evidence suggesting the suspect may have issued explicit orders for the homicides.<\/p>\n

Concurrently, the FBI released a formal video address delivered by Brett Leatherman, assistant director of the bureau’s cyber division. Leatherman expressed profound appreciation for the collaborative efforts of Dutch law enforcement partners and issued a direct warning to remaining members of the ShinyHunters collective.<\/p>\n

"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who\u2019s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."<\/p>\n","protected":false},"excerpt":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in high-stakes data thefts and corporate extortions orchestrated by the prolific and aggressive hacker group known as ShinyHunters. The high-profile arrest has sent immediate shockwaves through the underground cybercrime ecosystem, triggering a dramatic and dangerous escalation in retaliatory operations by remaining<\/p>\n","protected":false},"author":23,"featured_media":1121,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[149,423,893,894,143,146,147,1240,144,1239,1238,1237,145],"class_list":["post-1122","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-arrest","tag-attacks","tag-convicted","tag-cybercriminal","tag-cybersecurity","tag-defense","tag-dutch","tag-fallout","tag-hacking","tag-international","tag-retaliatory","tag-sparking","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1122"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1122\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1121"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}