{"id":978,"date":"2026-10-08T14:51:26","date_gmt":"2026-10-08T14:51:26","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=978"},"modified":"2026-10-08T14:51:26","modified_gmt":"2026-10-08T14:51:26","slug":"dutch-authorities-arrest-convicted-cybercriminal-linked-to-shinyhunters-as-infamous-hacking-collective-escalates-attacks-2","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=978","title":{"rendered":"Dutch Authorities Arrest Convicted Cybercriminal Linked to ShinyHunters as Infamous Hacking Collective Escalates Attacks"},"content":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-profile extortions orchestrated by the prolific hacker group ShinyHunters. In the days immediately following the suspect\u2019s apprehension, remaining members of the ShinyHunters collective dramatically escalated their campaign, launching aggressive attacks that included stealing highly sensitive data from the Federal Bureau of Investigation (FBI) and extorting the Russian-speaking ransomware group Cl0p.<\/p>\n

According to three sources familiar with the matter, the Dutch man taken into custody by authorities this month is Pepijn van der Stap, a convicted cybercriminal originally from Almere and Lelystad in the Netherlands. Van der Stap was previously convicted in late 2023 for his involvement in a sweeping series of data thefts and corporate extortions. Prosecutors at the time estimated that those illicit activities generated between \u20ac1.5 million and \u20ac2.7 million in criminal proceeds.<\/p>\n

During his trial in 2023, van der Stap openly admitted to living a dual existence. Secretly operating under the hacker handle \u201cUmbreon,\u201d he extorted corporate victims and published stolen data on English-language underground hacking communities, including the now-defunct forums RaidForums and Breached. By day, however, van der Stap maintained a conventional professional life as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also volunteered his technical skills with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization dedicated to independent security research.<\/p>\n

Van der Stap confessed to his extensive data theft and extortion activities during court proceedings and was sentenced to four years in prison, with one year suspended. In a somewhat unusual move during his trial, van der Stap opted to remain in custody rather than return home, stating that he could not find better treatment on the outside for his ongoing psychological struggles, which he claimed included post-traumatic stress disorder stemming from childhood trauma. He was eventually released from prison in December 2025.<\/p>\n

In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a reformed individual genuinely attempting to turn his life around and make positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that ultimately did not respond to requests for comment regarding the arrest.<\/p>\n

During that September conversation, van der Stap noted that he was still dealing with lingering civil lawsuits and financial restitution demands stemming from his past cybercrimes, emphasizing that he was doing his best to make amends. However, shortly after the interview concluded, van der Stap abruptly stopped replying to messages. Efforts by associates and individuals close to him to establish contact repeatedly failed over the subsequent two weeks.<\/p>\n

\"Dutch<\/figure>\n

According to two sources with direct knowledge of the situation, van der Stap was arrested by Dutch law enforcement officers on or around September 16 and has remained in custody for interrogation. One source reported that a colleague personally witnessed Dutch authorities removing boxes and equipment from van der Stap\u2019s residence during the raid.<\/p>\n

The Dutch police have spent months investigating the wider ShinyHunters network. Earlier in September, law enforcement agencies launched a public appeal seeking help to identify a voice recorded in a February 2026 telephone call. In that audio clip, a native Dutch-speaking member of ShinyHunters successfully used social engineering techniques to compromise Odido, the largest mobile telecommunications provider in the Netherlands. During the intrusion, the hackers tricked an Odido employee into logging into a spoofed website, leveraging that fraudulent access to steal personal data belonging to more than 6.2 million Dutch citizens.<\/p>\n

In statements to local media outlets, ShinyHunters confirmed that the suspect heard in the police audio recording is indeed an active member of their collective. In a public statement shared with the NL Times, the group wrote that their team member enjoyed their full emotional, mental, and financial support. The hackers claimed that legal representation and other necessary arrangements had been fully secured, adding dismissive remarks directed at the competence of Dutch law enforcement.<\/p>\n

FBI and Cl0p Cyberattacks<\/h2>\n

Just days after sources confirmed van der Stap\u2019s detention, ShinyHunters claimed responsibility for an extraordinarily brazen breach targeting the FBI\u2019s job application portal at apply.fbijobs.gov. Reporting from 404 Media and Reuters revealed that the stolen data included Social Security numbers and personal information pertaining to more than 5,000 current and prospective FBI officials. <\/p>\n

The compromised records detailed sensitive professional information, including the specific job titles and operational units of affected personnel, ranging from special agents and threat intake examiners to members of major cybercrime divisions and teams tasked with investigating foreign state-backed cyber threats. Furthermore, Reuters examined internal documents shared by the hackers and confirmed they contained sensitive psychiatric and medical files belonging to FBI employees. The bureau subsequently issued a brief public statement acknowledging the compromise of the portal.<\/p>\n

According to cybersecurity investigators, ShinyHunters gained access to the FBI portal and numerous other corporate systems by exploiting a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft\u2014a widely used software-as-a-service platform owned by Oracle that manages hiring, human resources, benefits, and payroll operations. Oracle swiftly released a security update after discovering that ShinyHunters had begun actively exploiting the vulnerability as a zero-day flaw since June. Although Mandiant issued web application firewall (WAF) rules to protect organizations unable to immediately apply the patch, security reports indicated that ShinyHunters subsequently utilized a URL-encoding trick to bypass those mitigation rules.<\/p>\n

\"Dutch<\/figure>\n

In a comprehensive threat intelligence report published on September 25, analysts from Mandiant and the Google Threat Intelligence Group confirmed that ShinyHunters had carried out a mass-exploitation campaign using the PeopleSoft vulnerability. The attacks impacted dozens of systems across diverse sectors, including higher education, technology, healthcare, agriculture, transportation, and government agencies.<\/p>\n

Notably, van der Stap\u2019s former hacker alias, Umbreon, was prominently featured in the imagery used by ShinyHunters to publicize the FBI breach. The defacement message left on the hacked FBI recruitment site featured an ASCII art depiction of the Pok\u00e9mon character Umbreon, accompanied by text declaring the site seized and referencing the group\u2019s longevity in compromising computer systems. The aesthetic was nearly identical to a defacement message previously deployed by ShinyHunters during their 2020 intrusion into Hackforums.<\/p>\n

Sources close to the ongoing international investigation indicated that the group\u2019s sudden, high-risk attacks against the FBI and major ransomware actors marked a significant departure from their traditionally calculated operational style. Investigators attribute this pivot to a leadership shift following a takeover of ShinyHunters by a teenage cybercriminal from Amman, Jordan, known by the alias "Rey." Rey operates within an amalgamated cybercrime syndicate called ScatteredLapsussHunters (SLSH), which security researchers describe as a coalition blending elements from Scattered Spider, LAPSUS$, and ShinyHunters.<\/p>\n

According to knowledgeable sources, Rey harbored an ongoing feud with the imprisoned Dutch hacker regarding control over the ShinyHunters brand and its troves of stolen data. The prominent inclusion of the Umbreon imagery in the FBI site defacement was widely viewed as a tactical attempt by Rey to implicate van der Stap in the high-profile federal breach.<\/p>\n

Rey was first publicly unmasked by cyber intelligence firm KELA in March 2025. Prior to a published profile by KrebsOnSecurity later that year, reporters contacted Rey\u2019s father to request an interview with the teenager. The father forwarded the inquiry directly to his son, who subsequently admitted to participating in ransomware operations while expressing a desire to distance himself from the SLSH syndicate.<\/p>\n

Following media coverage of the FBI hack, Rey utilized a primary account on social media platform X to taunt both the FBI and the Cl0p ransomware syndicate, posting provocative memes while featuring a large graphical rendering of the Umbreon character. Shortly after security researchers renewed inquiries regarding Rey\u2019s elevated status within ShinyHunters, the teenager deleted his social media account. Meanwhile, attempts to reach Rey\u2019s father, an employee of Royal Jordanian Airlines, regarding his son’s alleged illicit activities went unanswered.<\/p>\n

\"Dutch<\/figure>\n

The friction between SLSH and ShinyHunters stems in part from previous short-lived alliances. According to reports published by Wired, members of ShinyHunters and SLSH briefly partnered earlier in the year to monetize credentials harvested by TeamPCP, an emerging group that successfully infiltrated global code supply chains but struggled to profit from the stolen assets. Two alleged leaders of TeamPCP were subsequently arrested in Australia. Mandiant analysts later revealed that security researchers had covertly infiltrated TeamPCP and actively burned stolen credentials by feeding them to major cloud providers like Amazon and Microsoft, rendering the access keys worthless and sparking mutual accusations of betrayal among the allied criminal factions.<\/p>\n

Despite internal conflicts, security analysts note that ShinyHunters has maintained a lucrative extortion spree throughout the year. Mandiant researcher Austin Larsen estimated that the collective remains on track to extract nearly $100 million in extortion payments from corporate and government victims.<\/p>\n

Van der Stap has consistently maintained that his early criminal activities were never driven primarily by financial gain. In previous interviews with journalists, he described his primary motivation as a compulsion to compile the world’s most exhaustive collection of stolen databases, explaining that his primary focus centered on gathering, organizing, and cataloging data rather than monetary extortion.<\/p>\n

Meanwhile, the DIVD, where van der Stap previously volunteered, disclosed an internal cybersecurity incident involving the potential malicious use of artificial intelligence. However, representatives for the nonprofit confirmed that the event was unrelated to ShinyHunters and bore no connection to the organization’s former volunteer.<\/p>\n

Dutch police formally confirmed the arrest of the 24-year-old suspect in connection with the ongoing ShinyHunters investigation. Authorities announced that the individual would appear before the Rotterdam District Court as the investigation continues to unfold. Concurrently, international law enforcement partners continue to pursue remaining members of the network. Brett Leatherman, assistant director of the FBI\u2019s cyber division, acknowledged the cooperation of Dutch law enforcement and urged remaining members of ShinyHunters to surrender, noting that law enforcement pressure and seized infrastructure continue to reveal the identities of those involved.<\/p>\n","protected":false},"excerpt":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-profile extortions orchestrated by the prolific hacker group ShinyHunters. In the days immediately following the suspect\u2019s apprehension, remaining members of the ShinyHunters collective dramatically escalated their campaign, launching aggressive attacks that included stealing highly sensitive data<\/p>\n","protected":false},"author":3,"featured_media":977,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[149,423,595,1081,893,894,143,146,147,1082,144,885,216,169,145],"class_list":["post-978","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-arrest","tag-attacks","tag-authorities","tag-collective","tag-convicted","tag-cybercriminal","tag-cybersecurity","tag-defense","tag-dutch","tag-escalates","tag-hacking","tag-infamous","tag-linked","tag-shinyhunters","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/978","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=978"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/978\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/977"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=978"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=978"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=978"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}