By Sagoh 
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions orchestrated by the prolific and aggressive hacker group known as ShinyHunters. The detention of the suspect has triggered an immediate and dramatic escalation from the remaining members of the collective, who launched retaliatory cyberattacks, stole highly sensitive records from the Federal Bureau of Investigation (FBI), and targeted the notorious Russian ransomware syndicate Cl0p.
According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement this month is Pepijn van der Stap, a convicted cybercriminal originally from Almere and Lelystad in the Netherlands. Van der Stap previously faced prosecution and was convicted in 2023 for his involvement in a sweeping series of data thefts and digital extortions. Dutch prosecutors stated at the time that those earlier cybercrime operations generated illicit proceeds estimated between €1.5 million and €2.7 million.
During his late 2023 trial, van der Stap admitted to living a dual life akin to Dr. Jekyll and Mr. Hyde. Under the online moniker "Umbreon"—named after the Pokémon character whose image he used as his avatar—he secretly extorted victims and published stolen databases on prominent English-language cybercrime forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap maintained a respectable professional profile, working as a software engineer for the Amsterdam-based cybersecurity startup Hadrian while simultaneously volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization dedicated to security research.
Van der Stap fully confessed to his illicit data-hoarding and extortion activities during the legal proceedings. He was subsequently sentenced to four years in prison, with one year suspended. Bizarrely, during the trial, van der Stap requested to remain in custody rather than return home under house arrest, arguing that he could not find adequate psychiatric care outside of a correctional facility for his ongoing mental health struggles, which he attributed to post-traumatic stress disorder stemming from childhood trauma. He was ultimately released from prison in December 2025.
In an interview with KrebsOnSecurity on September 9, 2026, van der Stap presented himself as a rehabilitated individual attempting to rebuild his life and make positive contributions to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that has thus far declined to respond to media requests for comment.
During the conversation, van der Stap noted that he was still navigating complex civil lawsuits and restitution requirements tied to the victims of his past cybercrimes, emphasizing that he was doing his utmost to make amends. However, shortly after that interview concluded, van der Stap abruptly stopped responding to electronic communications. Individuals close to him confirmed that repeated efforts to reach him over a two-week period went entirely unanswered.
According to two sources with direct knowledge of the situation, Dutch law enforcement officers arrested van der Stap on or around September 16. He has since been held in custody for intensive questioning. One source reported that a colleague personally witnessed police officers removing boxes of evidence and equipment from van der Stap’s residence.
Dutch authorities have faced immense pressure in recent months as they investigate the inner workings of ShinyHunters. Earlier in September, law enforcement agencies publicly appealed for assistance from the general public to identify an anonymous voice from a recorded telephone call dating back to February 2026. In that audio recording, a native Dutch-speaking operative associated with ShinyHunters successfully social-engineered their way into Odido, the largest mobile telecommunications provider in the Netherlands. During the intrusion, the hacker tricked an Odido employee into authenticating through a spoofed, malicious website, granting the threat actors unauthorized access to personal data belonging to more than 6.2 million Dutch citizens.
Reacting to local news coverage, ShinyHunters publicly verified that the individual heard in the released audio clip is indeed an active member of their collective. In a statement provided to the Dutch publication NL Times, the hackers wrote that their team member enjoyed their complete backing—emotionally, mentally, and financially. The group asserted that they had arranged comprehensive legal defense and financial support, stating that they take excellent care of their personnel.
The collective also launched a vitriolic verbal assault against Dutch law enforcement agencies. In their statement, ShinyHunters mocked the competency of the police, claiming they would need immense luck and public prayers to capture their operatives before the group carried out further large-scale cyberattacks within the Netherlands, dismissing the authorities as entirely incompetent and irrelevant.
FBI, CL0P HACKS
Just days after sources indicated van der Stap was detained by Dutch authorities, ShinyHunters claimed responsibility for an extraordinarily brazen cyberattack targeting the FBI’s job application portal, apply.fbijobs.gov. According to investigative reporting by 404 Media, the data extracted from the federal employment portal included sensitive personally identifiable information, including Social Security numbers and private records concerning more than 5,000 agency personnel.
Both 404 Media and Reuters reported that the compromised FBI files contained specific job titles and operational unit assignments, identifying personnel working within special agent positions, threat intake examination, major cybercrime squads, and teams dedicated to investigating foreign state-sponsored cyber threats. Furthermore, documents reviewed by Reuters revealed that the leak included confidential medical and psychiatric evaluations of FBI employees. The bureau subsequently released a brief official statement acknowledging the unauthorized compromise of the job application portal.
ShinyHunters stated that they penetrated the FBI website and numerous other victim networks by exploiting a newly patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft—a widely utilized enterprise software-as-a-service platform developed by Oracle for human resources, payroll, and recruitment management. Oracle rapidly issued a security patch after discovering that the group had been actively weaponizing the flaw as a zero-day exploit since June. Concurrently, cybersecurity firm Mandiant released web application firewall rules to assist organizations unable to immediately apply the software updates.
However, subsequent technical analyses published by BleepingComputer revealed that ShinyHunters circumvented Mandiant’s mitigation guidelines by employing a clever URL-encoding evasion trick. In a joint threat intelligence report released on September 25, security analysts from Mandiant and the Google Threat Intelligence Group confirmed that the hacking collective had conducted a mass-exploitation campaign leveraging the PeopleSoft vulnerability to siphon data from dozens of organizations across diverse sectors, encompassing higher education, technology, healthcare, agriculture, transportation, and government agencies.
Intriguingly, van der Stap’s former hacker alias, Umbreon, appeared prominently within the visual materials deployed by ShinyHunters to publicize the FBI breach. The digital defacement message left behind on the compromised FBI portal featured ASCII art depicting the Pokémon character Umbreon alongside a taunting header declaring that the site had been seized by ShinyHunters, adding that they had been rooting corporate and government systems since 2019. The layout bore a striking resemblance to defacement graphics utilized by the group during their 2010 hack of the English-language cybercrime forum Hackforums.
Sources close to the ongoing investigation into ShinyHunters noted that the group’s sudden shift toward high-risk, high-profile targets like the FBI and a prominent Russian ransomware syndicate marked a stark departure from their historical operational methods. Analysts attribute this abrupt pivot to a hostile internal leadership takeover by a teenage cybercriminal from Amman, Jordan, who operates under the handle "Rey" and belongs to a coalition known as ScatteredLapsussHunters (SLSH)—an amalgam of three major cybercrime factions: Scattered Spider, LAPSUS$, and ShinyHunters.
According to these sources, Rey harbored an ongoing personal and territorial feud with the imprisoned Dutch hacker regarding control over the ShinyHunters brand and its vast repositories of stolen data. Investigators believe the inclusion of the oversized Umbreon imagery in the FBI portal defacement was an intentional maneuver by Rey designed to implicate van der Stap directly in the federal attack.
Rey was first publicly unmasked by cyber intelligence firm KELA in March 2025. Prior to publishing a detailed profile on the teenager, security journalists contacted Rey’s father to request an interview, though the father merely forwarded the inquiry to his son. Rey subsequently acknowledged his participation in various ransomware operations while simultaneously claiming he was attempting to extricate himself from the SLSH collective.
BLAMING UMBREON
Immediately following widespread media coverage of the FBI job site breach, Rey utilized his primary social media account on X, formerly known as Twitter, to taunt both the FBI and the Cl0p ransomware syndicate. One post featured a crude meme depicting the World Trade Center towers struck by aircraft labeled with references to the Cl0p drama and the FBI breach claim, with a massive balloon-like figure of the Pokémon character Umbreon looming in the foreground.
On September 24, reporters reached out to Rey’s father once again to request an interview concerning his son’s rising prominence within the upper echelons of ShinyHunters. Just hours after that outreach, Rey’s long-standing account on X was abruptly deleted. Meanwhile, Rey’s father, an employee of Royal Jordanian Airlines, has consistently declined to respond to repeated email inquiries regarding his son’s alleged illicit digital activities.
The underlying animosity between the SLSH faction and core members of ShinyHunters stems from a short-lived operational partnership earlier in the year. According to reporting by Wired, the groups briefly collaborated to better monetize valuable corporate credentials amassed by TeamPCP, an upstart gang specializing in software supply-chain compromises. Despite successfully breaching numerous global code repositories, TeamPCP struggled to extract substantial financial returns from their stolen assets—with alleged leaders later claiming they netted a mere $20,000 before two key figures were arrested by Australian authorities in August.
Behind the scenes, Mandiant analysts had secretly infiltrated TeamPCP’s infrastructure and began neutralizing the stolen credentials by funneling them directly to major cloud service providers like Amazon and Microsoft, which promptly invalidated the compromised access keys. As the operation collapsed, the allied hacker factions quickly turned on one another, trading accusations over who was responsible for rendering the credentials worthless.
According to Wired reporter Andy Greenberg, ShinyHunters ultimately went rogue, executing independent extortion campaigns using TeamPCP’s stolen credentials while intentionally withholding any financial cuts from the supply-chain hackers. Mandiant researcher Austin Larsen noted that ShinyHunters has experienced an exceptionally lucrative extortion spree throughout the year, putting the collective on track to amass nearly $100 million in illicit payments from corporate victims by the end of 2026.
Despite his extensive criminal history, van der Stap consistently maintained that financial gain was never his primary driver. In previous interviews with Bloomberg, he explained that his illegal activities were fueled by an obsessive compulsion to acquire and organize the world’s most comprehensive collection of leaked databases. Describing his behavior as simple data hoarding, he remarked that hacking came effortlessly to him and served primarily as a means to feed his habit of downloading, structuring, and cataloging digital archives.
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD)—the nonprofit research organization where van der Stap once volunteered—announced on LinkedIn that it was managing an internal cybersecurity incident involving the unauthorized use of artificial intelligence. Although DIVD provided minimal specifics regarding the security event, a spokesperson confirmed to reporters that the incident bore no connection to ShinyHunters and showed no signs of involvement from any former volunteers.
Dutch police officially confirmed the arrest of a 24-year-old suspect linked to the ongoing ShinyHunters investigation. In a public statement issued via social media, law enforcement announced that the detained individual would appear before the Rotterdam District Court, promising further updates as the inquiry progresses.
Concurrently, reports from Dutch news outlet RTL revealed that investigators are examining suspicions that van der Stap may have attempted to orchestrate at least two murders outside the Netherlands, with evidence suggesting the suspect allegedly issued directives for the killings to be carried out abroad.
Addressing the broader international investigation, Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement thanking Dutch law enforcement partners for their crucial assistance and issuing a direct warning to the remaining fugitive members of ShinyHunters.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Nila Kartika Wati 
Dwi Wanna