Dutch authorities arrest convicted cybercriminal linked to global ShinyHunters extortion spree

In a major development for international law enforcement, Dutch authorities have taken into custody 24-year-old Pepijn van der Stap, a convicted cybercriminal from Almere, on suspicion of providing critical support to the notorious hacker collective ShinyHunters. The arrest, which occurred on or around September 16, 2026, marks a pivotal moment in the ongoing battle against one of the most prolific and disruptive digital syndicates of the decade. Van der Stap, who previously operated under the hacker handle "Umbreon," stands accused of facilitating large-scale data thefts and complex extortion schemes that have targeted both high-profile government institutions and private enterprises across the globe.

The arrest has sent shockwaves through the dark web, triggering a volatile response from the remaining members of the ShinyHunters collective. Far from retreating, the group has engaged in an aggressive escalation of their activities, launching brazen attacks against the Federal Bureau of Investigation (FBI) and even targeting the Russian ransomware group Cl0p. This reaction highlights the group’s increasingly desperate and retaliatory operational posture in the wake of the loss of one of their key associates.

A History of Dual Lives

Van der Stap’s criminal trajectory is as complex as the digital landscape he navigated. During his 2023 trial, prosecutors detailed a "Dr. Jekyll and Mr. Hyde" persona that saw the young man balance a legitimate career as a software engineer at the Amsterdam-based cybersecurity startup Hadrian with a clandestine life as a high-level threat actor. His activities included selling stolen databases—containing information on over 2.3 million Dutch citizens—on platforms such as the now-defunct RaidForums and Breached.

Despite his previous conviction, which resulted in a four-year prison sentence (with one year suspended), Van der Stap had maintained a public image of reform. Following his release in December 2025, he secured a position as an offensive security lead at the Dutch firm Neo Security. In a September 2026 interview, he claimed to be making amends for his past, yet the proximity of his arrest to the recent surge in ShinyHunters activity suggests his involvement in the criminal underworld remained far more active than his public persona implied.

The gravity of the situation intensified on September 29, when Dutch news outlet RTL reported that investigators now suspect Van der Stap of attempting to orchestrate at least two murders abroad. This escalation from cyber-extortion to the planning of violent crimes represents a severe darkening of his criminal profile and has complicated the legal proceedings significantly.

Chronology of Escalation

The recent surge in activity can be traced back to February 2026, when a native Dutch-speaking member of ShinyHunters successfully social-engineered their way into Odido, the Netherlands’ largest mobile telecommunications provider. By tricking an employee into accessing a spoofed portal, the attackers compromised the personal data of over 6.2 million individuals. The Dutch police, in an effort to identify the culprit, released audio clips of the social engineering attempt, confirming through independent verification that the voice belonged to a high-ranking ShinyHunters operative.

The subsequent timeline of events unfolded rapidly:

• September 16, 2026: Dutch authorities arrest Pepijn van der Stap, executing a search warrant at his residence and seizing extensive hardware and digital evidence.
• September 18, 2026: ShinyHunters releases a statement via the NL Times, branding the Dutch police as "incompetent" and "irrelevant," while vowing to provide full financial and legal support to their detained member.
• Late September 2026: The group breaches the FBI’s job application portal (apply.fbijobs.gov), leaking sensitive personal information—including Social Security numbers and psychiatric records—of over 5,000 FBI personnel.
• September 29, 2026: Official court appearances begin in Rotterdam as new allegations regarding murder-for-hire plots emerge.

The Rise of "Rey" and the SLSH Collective

The recent pivot toward more reckless and high-stakes operations is attributed by security analysts to a leadership transition within the group. Sources familiar with the investigation indicate that the ShinyHunters brand has been subsumed by "Rey," a teenage cybercriminal based in Amman, Jordan. Rey is a central figure in a broader alliance known as ScatteredLapsussHunters (SLSH), which combines the resources and tactics of Scattered Spider, LAPSUS$, and ShinyHunters.

The internal power struggle between Van der Stap and Rey appears to be a defining factor in recent leaks. Security experts believe the inclusion of the "Umbreon" ASCII art in the FBI defacement was a calculated move by Rey to frame the Dutch hacker for the high-profile breach, effectively burning his associate to protect the group’s leadership structure. The volatility of this relationship is further underscored by the collapse of a brief partnership between SLSH and the supply-chain hacking group TeamPCP, which ended in mutual recriminations after their stolen credentials were neutralized by cloud providers working in tandem with Mandiant researchers.

Official Responses and Institutional Impact

The FBI has formally acknowledged the breach of its recruitment portal. Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement commending the Dutch National Police for their cooperation. Leatherman’s message served as both a thank-you to international partners and a stern warning to the remaining members of ShinyHunters: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left."

The impact on the global security landscape is profound. ShinyHunters is currently estimated to be on track to extract nearly $100 million in extortion payments throughout 2026. Their use of zero-day vulnerabilities in Oracle’s PeopleSoft software, combined with sophisticated URL-encoding tricks to bypass web application firewalls, demonstrates a level of technical capability that poses a systemic risk to organizations worldwide.

Analysis of Implications

The case of Pepijn van der Stap serves as a sobering reminder of the "gray area" in cybersecurity, where high-level technical talent can easily pivot between defensive research and offensive criminal activity. The involvement of organizations like the Dutch Institute for Vulnerability Disclosure (DIVD), where Van der Stap once volunteered, highlights the vulnerability of nonprofit research groups to infiltration by bad actors seeking to burnish their reputations or gain access to sensitive vulnerability data.

Furthermore, the shift in tactics by ShinyHunters—moving away from pure data theft toward high-profile, politically sensitive targets like the FBI—marks a dangerous evolution in the ransomware-as-a-service model. By deliberately provoking law enforcement and intelligence agencies, the group has moved from a "profit-first" business model to one that invites intense, prioritized scrutiny from the world’s most capable state-level cyber investigators.

As the Dutch court proceedings move forward, the legal community will be watching closely to see how the combination of cyber-extortion charges and the emerging murder-for-hire allegations are adjudicated. The case will likely set a precedent for how international law enforcement treats "reformed" hackers who maintain clandestine connections to active, hostile collectives. For now, the arrest of Van der Stap remains a significant blow to the operational capacity of ShinyHunters, though the group’s history of resilience suggests that the battle against the SLSH network is far from over.