During that same conversation, van der Stap noted that he was still actively dealing with lingering civil lawsuits and financial restitution requirements related to his past cybercrimes, emphasizing that he was doing his best to make amends. However, shortly after that interview concluded, van der Stap abruptly ceased responding to communications. Efforts by acquaintances and associates to reach him repeatedly failed over the following two weeks.<\/p>\n
According to two sources with direct knowledge of the situation, Dutch authorities arrested van der Stap on or around September 16, subsequently holding him in secure custody for intensive questioning. One source reported that a colleague personally witnessed law enforcement officers carrying various items and electronic equipment out of van der Stap\u2019s residence during the raid.<\/p>\n
The arrest coincides with an intensive public appeal by Dutch law enforcement. Earlier in September, authorities released a recorded telephone call from February 2026, asking the public for assistance in identifying a native Dutch speaker who successfully social-engineered their way into Odido, the Netherlands’ largest mobile telecommunications provider. During that intrusion, the ShinyHunters operative tricked an Odido employee into authenticating their credentials on a spoofed website, leveraging that unauthorized access to steal personal data belonging to more than 6.2 million Dutch citizens.<\/p>\n Responding to inquiries from local news media, ShinyHunters publicly confirmed that the suspect heard in the police audio clip is indeed a member of their hacking collective. In a defiant statement shared with the NL Times<\/em>, the group vowed unconditional support for their arrested comrade. <\/p>\n "Our team member has our full support\u2014emotionally, mentally, and financially," the hackers stated. "Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them." <\/p>\n The collective also lashed out directly at Dutch law enforcement agencies. "The Dutch police will need all the luck in the world\u2014and everyone\u2019s prayers\u2014if they want to catch him before we carry out another large-scale data theft in the Netherlands," the statement read. "Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."<\/p>\n The Dutch police subsequently confirmed the arrest of a 24-year-old individual in connection with the ongoing ShinyHunters investigation. In a statement posted to social media, law enforcement announced that the suspect would appear before the chambers of the Rotterdam District Court. Furthermore, investigative reports from the Dutch news outlet RTL<\/em> revealed that authorities are also probing whether van der Stap attempted to orchestrate at least two murders abroad, with investigators uncovering indications that the suspect may have issued orders for the killings.<\/p>\n Just days after van der Stap was detained by authorities, ShinyHunters claimed responsibility for an unusually brazen and high-profile cyberattack targeting the FBI\u2019s job application portal, Both 404 Media<\/em> and Reuters<\/em> reported that the compromised FBI records contained specific job titles and operational team assignments, identifying personnel working within major cybercrimes units, threat intake examination desks, and divisions tasked with investigating state-sponsored foreign cyber threats. Furthermore, documents examined by Reuters<\/em> indicated that the stolen files included confidential psychiatric and medical records of bureau personnel. The FBI issued a brief press statement formally acknowledging the compromise of the portal and the resulting impact on employee personally identifiable information.<\/p>\n According to ShinyHunters, access to the FBI portal and other victim systems was achieved by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft\u2014a widely used enterprise software-as-a-service platform from Oracle utilized globally for human resources, recruitment, benefits administration, and payroll management. Oracle swiftly released security patches for the PeopleSoft vulnerability after discovering that ShinyHunters had been actively exploiting the flaw as a zero-day since June. In response, Mandiant had previously released web application firewall (WAF) rules designed to protect organizations that could not immediately apply the software updates.<\/p>\n However, subsequent technical disclosures revealed that ShinyHunters managed to circumvent Mandiant\u2019s mitigation rules by employing a URL-encoding trick. In a joint threat intelligence report published by Mandiant and the Google Threat Intelligence Group, security experts confirmed that ShinyHunters had executed a mass-exploitation campaign targeting the PeopleSoft vulnerability across dozens of organizations spanning diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.<\/p>\n Intriguingly, van der Stap\u2019s former hacker alias, Umbreon, was hidden in plain sight within the visual artifacts left behind by ShinyHunters during the FBI portal breach. The defacement image posted on the hacked recruitment site featured an ASCII art rendering of the Pok\u00e9mon character Umbreon alongside a taunting message declaring that the site had been seized by the hacking collective. The imagery appeared identical to a defacement banner previously utilized by ShinyHunters during their 2020 compromise of the English-language cybercrime community Hackforums.<\/p>\n Sources close to the investigation into ShinyHunters noted that these aggressive and risky operations against both the FBI and Cl0p\u2014one of Russia\u2019s most established ransomware syndicates\u2014marked a sharp departure from the group’s historical operational style. This sudden strategic pivot reportedly followed a leadership shift within ShinyHunters, which fell under the control of a teenage cybercriminal from Amman, Jordan. Known by the online moniker "Rey," this individual operates as a prominent figure within ScatteredLapsussHunters, a hybrid cybercrime organization formed through the amalgamation of three notorious hacking groups: Scattered Spider, LAPSUS$, and ShinyHunters.<\/p>\n Investigators suggest that Rey harbored a lingering personal grievance against van der Stap regarding control over the ShinyHunters brand and accumulated data. Consequently, the prominent inclusion of the oversized Umbreon imagery in the FBI site defacement was interpreted by security analysts as a deliberate attempt by Rey to implicate the imprisoned Dutch hacker in the high-profile attack.<\/p>\n Rey was first publicly unmasked by the cybersecurity firm KELA in March 2025. Prior to publishing a detailed profile on the young administrator, security researchers contacted Rey\u2019s father, who simply forwarded the communication to his son. Rey subsequently admitted to participating in ransomware activities while expressing a desire to distance himself from the hybrid hacking collective.<\/p>\n Immediately following the media coverage of the FBI portal breach, Rey\u2019s primary social media account on X (formerly Twitter) was used to mock both the FBI and the Cl0p ransomware group. The posts featured satirical imagery depicting the entities as prominent structures struck by digital disruptions, framed by a giant floating figure of the Pok\u00e9mon character Umbreon. Shortly after media inquiries were directed to his family regarding his alleged leadership role in ShinyHunters, Rey deactivated his social media accounts, while his father, an employee of Royal Jordanian Airlines, declined to respond to repeated requests for comment.<\/p>\n The underlying friction between the hybrid faction and ShinyHunters traces back to earlier operational partnerships. According to an investigative report published by Wired<\/em>, members of ShinyHunters and the hybrid collective had briefly collaborated earlier in the year to monetize stolen credentials harvested by TeamPCP. TeamPCP was an upstart hacking group that specialized in compromising global software supply chains with malicious code but lacked effective mechanisms to monetize the vast amounts of stolen data they accumulated. <\/p>\n Although two alleged leaders of TeamPCP were arrested in Australia, investigative reports revealed that Mandiant had covertly infiltrated the group. Mandiant was secretly responsible for burning the stolen credentials by rapidly feeding them to major cloud providers such as Amazon and Microsoft, which promptly invalidated the keys before the hackers could leverage them. As the operation collapsed, the cooperating cybercrime factions began trading blame for the security interventions that rendered their stolen data worthless.<\/p>\n According to Wired<\/em>, shortly after partnering with TeamPCP, ShinyHunters went rogue by executing independent extortions using the compromised supply-chain credentials without sharing the proceeds with their partners. Security researchers from Mandiant noted that ShinyHunters has enjoyed a remarkably lucrative extortion campaign throughout the year, putting the collective on track to amass nearly $100 million in extortion payments from victims globally.<\/p>\n Despite his extensive criminal history, van der Stap previously maintained that his primary motivation was never financial gain. In earlier interviews, he described his cyberattacks as driven by an obsessive compulsion to curate the world\u2019s most comprehensive repository of stolen databases. <\/p>\n "The hacking was very easy for me, and it wasn\u2019t a compulsion," van der Stap told Bloomberg<\/em> in 2024. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."<\/p>\n Meanwhile, the DIVD, the nonprofit security research organization where van der Stap previously volunteered, reported an internal cybersecurity incident involving the suspected malicious application of artificial intelligence. While the organization disclosed few specifics regarding the breach, a DIVD spokesperson confirmed that the incident appeared entirely unrelated to ShinyHunters and showed no connection to the work of any former volunteers.<\/p>\n In the wake of these developments, the international law enforcement response has intensified. Brett Leatherman, assistant director of the FBI\u2019s cyber division, released a video message addressing the ongoing investigation into ShinyHunters. Leatherman thanked Dutch law enforcement partners for their crucial assistance and issued a direct warning to the remaining members of the hacking collective.<\/p>\n "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who\u2019s left," Leatherman said. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."<\/p>\n","protected":false},"excerpt":{"rendered":" Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions carried out by the prolific hacker collective known as ShinyHunters. The detention of the suspect, which took place in mid-September, has triggered a dramatic and volatile escalation within the global cybercrime underworld. In the<\/p>\n","protected":false},"author":9,"featured_media":1471,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[198],"tags":[149,595,893,894,146,147,897,1239,216,880,1458,184,205,169,204],"class_list":["post-1472","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing-social-engineering","tag-arrest","tag-authorities","tag-convicted","tag-cybercriminal","tag-defense","tag-dutch","tag-escalation","tag-international","tag-linked","tag-major","tag-manhunt","tag-phishing","tag-security-awareness","tag-shinyhunters","tag-social-engineering"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1472"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1472\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1471"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Dutch](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/umbreon-nl-rf.png\")
<\/figure>\nFBI, CL0P HACKS<\/h2>\n
apply.fbijobs.gov<\/code>. According to reporting by 404 Media<\/em>, the data exfiltrated during this breach included Social Security numbers and sensitive personal information belonging to more than 5,000 bureau officials and applicants.<\/p>\n![\"Dutch](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/pvds-li.png\")
<\/figure>\n![\"Dutch](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/fbi-umbreon-sh.png\")
<\/figure>\n