{"id":906,"date":"2026-10-07T22:51:27","date_gmt":"2026-10-07T22:51:27","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=906"},"modified":"2026-10-07T22:51:27","modified_gmt":"2026-10-07T22:51:27","slug":"dutch-arrest-of-convicted-hacker-triggers-escalated-attacks-on-fbi-and-global-targets-by-shinyhunters","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=906","title":{"rendered":"Dutch Arrest of Convicted Hacker Triggers Escalated Attacks on FBI and Global Targets by ShinyHunters"},"content":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in sophisticated data thefts and widespread extortions orchestrated by the prolific and aggressive hacker collective known as ShinyHunters. The high-stakes apprehension has sent immediate shockwaves through the cybercrime underworld, triggering a dramatic escalation in retaliatory and high-profile attacks by remaining members of the group. In the days immediately following the suspect’s detention, ShinyHunters launched brazen digital intrusions, stealing highly sensitive personal and medical data from the Federal Bureau of Investigation (FBI) and moving to extort the notorious Russian ransomware syndicate Cl0p.<\/p>\n

According to three independent sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a previously convicted cybercriminal from Almere and Lelystad in the Netherlands. Van der Stap had earlier faced prosecution in connection with an extensive string of data thefts and high-pressure extortions. Dutch prosecutors stated at the time that those illicit campaigns successfully generated between \u20ac1.5 million and \u20ac2.7 million in illicit proceeds.<\/p>\n

During his criminal trial in late 2023, van der Stap admitted to leading a double life. Behind closed doors, he secretly operated under the hacker handle \u201cUmbreon,\u201d using the moniker to extort vulnerable victims and publish stolen databases on prominent English-language hacking forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a completely different facade, working professionally as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also volunteered his technical skills at the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research organization dedicated to identifying and mitigating software vulnerabilities.<\/p>\n

Van der Stap confessed openly during his trial to his extensive involvement in data theft and extortion schemes. Ultimately, he was sentenced to four years in prison, with one year suspended. During the legal proceedings, van der Stap elected to remain in custody rather than return home, explaining to the court that he could not find adequate medical or psychological treatment on the outside for his ongoing mental health struggles, which he noted included post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.<\/p>\n

In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as an individual who had fundamentally reformed his life, stating he was actively trying to make a positive and lawful contribution to society. At the time of his recent detention, van der Stap was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that did not respond to multiple requests for comment from journalists. <\/p>\n

Van der Stap mentioned during the interview that he was still navigating complex civil lawsuits and court-ordered restitution related to the victims of his past cybercrimes, insisting he was doing his best to make amends. However, shortly after that conversation, the Dutch hacker abruptly ceased responding to messages. Efforts by acquaintances and individuals close to him to establish contact repeatedly failed over the subsequent two weeks.<\/p>\n

According to two sources with direct knowledge of the investigation, van der Stap was arrested by Dutch authorities on or around September 16 and has since been held in custody for intensive questioning. One source noted that a colleague personally witnessed law enforcement officers removing numerous electronic items and other materials from van der Stap\u2019s residence during the raid.<\/p>\n

Law enforcement agencies in the Netherlands have actively sought public assistance in identifying individuals linked to the group’s operations. Earlier in the month, Dutch police published an audio recording from February 2026, asking the public to help identify the voice of a native Dutch-speaking ShinyHunters member who successfully used social engineering tactics to breach Odido, the nation’s largest mobile telecommunications provider. During that intrusion, the hacker tricked an Odido employee into logging into a spoofed, malicious website, subsequently leveraging that compromised access to steal sensitive data belonging to more than 6.2 million Dutch citizens.<\/p>\n

\"Dutch<\/figure>\n

Responding directly to inquiries from Dutch news media outlets, ShinyHunters confirmed that the suspect heard in the released audio clip is indeed an active member of their decentralized collective. In a public statement shared with the NL Times, the group expressed staunch backing for their arrested associate. <\/p>\n

\u201cOur team member has our full support \u2014 emotionally, mentally, and financially,\u201d the hackers stated. \u201cEverything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them.\u201d <\/p>\n

The collective also issued a hostile warning directed at Dutch law enforcement. \u201cThe Dutch police will need all the luck in the world \u2014 and everyone\u2019s prayers \u2014 if they want to catch him before we carry out another large-scale data theft in the Netherlands,\u201d the statement read, adding derogatory remarks criticizing the competence of the investigating agencies. The specialized Dutch police unit handling the Odido breach declined to comment on whether officers had successfully matched the voice on the recording to a confirmed real-world identity.<\/p>\n

FBI, CL0P HACKS<\/h2>\n

Just days after sources indicated van der Stap was detained by Dutch authorities, ShinyHunters shocked the cybersecurity community by claiming credit for an unusually brazen and targeted breach affecting the FBI\u2019s official job application portal, apply.fbijobs.gov. Reporting from 404 Media revealed that the data compromised in the incident included Social Security numbers and deeply personal information belonging to more than 5,000 current and prospective FBI officials.<\/p>\n

According to 404 Media and Reuters, the stolen records included specific job titles and operational team assignments, identifying personnel working in sensitive areas such as special agents, threat intake examiners, major cybercrimes units, and investigators tasked with countering cyber threats originating from foreign state-backed actors. Furthermore, Reuters examined document samples shared by the hackers, confirming they contained confidential psychiatric and medical files pertaining to FBI staff members. The bureau subsequently issued a brief public statement acknowledging the unauthorized compromise of the portal.<\/p>\n

ShinyHunters asserted that they gained initial access to the FBI portal and numerous other victim networks by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widely utilized software-as-a-service platform developed by Oracle that corporations and government agencies rely upon for managing human resources, hiring processes, employee benefits, and payroll infrastructure. Oracle moved swiftly to release a security update addressing the flaw after discovering that ShinyHunters had been actively exploiting it as a zero-day vulnerability since June. At the time of the initial discovery, Mandiant issued temporary web application firewall rules designed to protect organizations that could not immediately apply the vendor patch.<\/p>\n

However, subsequent reporting from BleepingComputer exposed that ShinyHunters circumvented Mandiant\u2019s recommended mitigations by employing a clever URL-encoding trick to bypass the web application firewall rules. In a joint threat intelligence report published on September 25, security analysts from Mandiant and the Google Threat Intelligence Group confirmed that the hacking group had engaged in a widespread, mass-exploitation campaign targeting the PeopleSoft vulnerability across a diverse array of sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.<\/p>\n

Intriguingly, van der Stap\u2019s former hacker alias, Umbreon, was hidden in plain sight within the digital imagery ShinyHunters utilized to publicize the FBI breach. The defacement graphic left behind on the compromised FBI jobs portal featured an ASCII art rendering of the Pok\u00e9mon character Umbreon. A banner at the top of the image proclaimed, \u201cThis site has been seized by ShinyHunters. rooting your systems since \u201919 ;)\u201d Security researchers noted that the graphic appeared identical to a defacement message previously deployed by ShinyHunters during their 2020 hack of the English-language cybercrime community Hackforums.<\/p>\n

\"Dutch<\/figure>\n

Sources close to the ongoing international investigation into ShinyHunters noted that the group’s recent, highly risky attacks against both the FBI and Cl0p\u2014one of Russia\u2019s most prominent and established ransomware syndicates\u2014marked a drastic pivot away from the more calculated and measured operational style the gang typically favored. Investigators indicated that this sudden escalation and shift in tactics followed an internal leadership takeover within ShinyHunters. The group reportedly fell under the control of a teenage cybercriminal from Amman, Jordan, who operates under the handle \u201cRey\u201d and is associated with a coalition called ScatteredLapsussHunters. Security experts describe this coalition as an amalgamation of three notorious cybercrime entities: Scattered Spider, LAPSUS$, and ShinyHunters.<\/p>\n

According to insider accounts, Rey maintained a prolonged and bitter dispute with the Dutch hacker over control of the ShinyHunters brand and its vast repositories of stolen data. Investigators believe the inclusion of the prominent Umbreon Pok\u00e9mon imagery in the FBI portal defacement was an intentional maneuver orchestrated by Rey to pin the high-profile attack directly on van der Stap.<\/p>\n

Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Ahead of a subsequent journalistic profile published later that year, inquiries directed to Rey’s family resulted in the teenager admitting to his participation in ransomware campaigns while expressing a desire to distance himself from the syndicate.<\/p>\n

BLAMING UMBREON<\/h2>\n

Immediately following widespread media coverage of the FBI jobs site breach, social media accounts linked to Rey began taunting both the FBI and the Cl0p ransomware group. One widely circulated meme posted online crudely depicted the groups as the twin towers of New York City being struck by aircraft labeled with references to the Cl0p conflict and the FBI breach claim, with a giant floating representation of the Pok\u00e9mon character Umbreon looming in the foreground.<\/p>\n

Tensions between the various factions within the cybercrime underground trace back to earlier partnerships. According to an investigative report published by Wired, ShinyHunters and members of the ScatteredLapsussHunters coalition temporarily joined forces earlier in the year to better monetize stolen corporate credentials harvested by TeamPCP. TeamPCP was an upstart hacking faction that achieved significant success compromising global software supply chains with malicious code, but struggled to successfully convert their stolen data into financial profits. Two alleged leaders of TeamPCP were subsequently arrested in Australia, with reports indicating their total earnings from the operations amounted to a modest $20,000.<\/p>\n

Wired reported that Mandiant analysts had secretly infiltrated TeamPCP\u2019s infrastructure and were quietly responsible for neutralizing the stolen credentials before the hackers could cash in. Mandiant was surreptitiously feeding the captured API keys and credentials directly to major cloud service providers like Amazon and Microsoft, prompting those companies to rapidly invalidate the compromised access keys. As the operations crumbled, the allied hacker factions began pointing fingers and blaming one another for rendering the stolen assets worthless.<\/p>\n

Mandiant researcher Austin Larsen noted that ShinyHunters has otherwise enjoyed a remarkably lucrative extortion streak throughout the year, remaining on track to pull in nearly $100 million in extortion payments from corporate victims by the close of 2026.<\/p>\n

Despite his extensive history in cybercrime, van der Stap previously maintained that financial gain was never his primary driver. Instead, he claimed his illegal activities were fueled by a compulsive desire to amass the world’s most comprehensive repository of stolen databases. In a 2024 interview with Bloomberg, van der Stap described his obsession with data accumulation.<\/p>\n

\"Dutch<\/figure>\n

\u201cThe hacking was very easy for me, and it wasn\u2019t a compulsion,\u201d he stated. \u201cMy habit was collecting. Collecting data, organizing data, downloading data, creating folders.\u201d<\/p>\n

Meanwhile, the Dutch Institute for Vulnerability Disclosure, the nonprofit research group where van der Stap previously volunteered, disclosed on social media that it was managing an internal cybersecurity incident involving the potential malicious use of artificial intelligence. While DIVD provided limited details regarding the event, a spokesperson confirmed to reporters that the incident bore no connection to ShinyHunters and showed no signs of involving the past activities of any former volunteer.<\/p>\n

Later in the week, the Dutch police officially confirmed the arrest of a 24-year-old male in connection with the ongoing ShinyHunters investigation. In a public statement issued via social media, law enforcement announced that the suspect would appear before the chambers of the Rotterdam District Court as the investigation continues to unfold. <\/p>\n

Further complicating the legal landscape, Dutch news outlet RTL reported that investigators are examining suspicions that van der Stap attempted to orchestrate at least two murders. According to those reports, the alleged contract killings were intended to take place abroad, and investigators are reviewing indications that the suspect issued direct orders for the plots.<\/p>\n

Addressing the broader international crackdown, Brett Leatherman, assistant director of the FBI\u2019s cyber division, released a video statement thanking Dutch law enforcement partners for their critical assistance and urging remaining members of the ShinyHunters collective to surrender voluntarily.<\/p>\n

\u201cArrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who\u2019s left,\u201d Leatherman said. \u201cThe longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in sophisticated data thefts and widespread extortions orchestrated by the prolific and aggressive hacker collective known as ShinyHunters. The high-stakes apprehension has sent immediate shockwaves through the cybercrime underworld, triggering a dramatic escalation in retaliatory and high-profile attacks by remaining members<\/p>\n","protected":false},"author":18,"featured_media":905,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[149,423,893,143,146,147,1052,906,151,144,169,180,145,895],"class_list":["post-906","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-arrest","tag-attacks","tag-convicted","tag-cybersecurity","tag-defense","tag-dutch","tag-escalated","tag-global","tag-hacker","tag-hacking","tag-shinyhunters","tag-targets","tag-threats","tag-triggers"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=906"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/906\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/905"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=906"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}