Dutch Authorities Arrest Former Cybersecurity Professional Linked to Global ShinyHunters Hacking Syndicate
The landscape of international cybercrime has shifted dramatically following the arrest of 24-year-old Pepijn van der Stap, a Dutch national previously convicted of major data thefts. Dutch authorities detained van der Stap in mid-September 2026, marking a significant escalation in the investigation into ShinyHunters, a prolific hacking collective responsible for a series of high-profile breaches. The arrest has triggered a volatile reaction from the remaining members of the group, who have since pivoted toward increasingly brazen attacks against government agencies and rival ransomware organizations, while simultaneously attempting to frame the imprisoned van der Stap for their latest activities.
The suspect, a resident of Almere and Lelystad, is a well-known figure within European cybersecurity circles. In 2023, he was convicted for his role in orchestrating a spree of data exfiltration and extortion schemes that netted between €1.5 million and €2.7 million. During his trial, van der Stap offered a chilling glimpse into a double life: by day, he functioned as a respected software engineer for the Amsterdam-based startup Hadrian and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD); by night, he operated under the alias "Umbreon," weaponizing his technical expertise to leak databases on illicit forums such as RaidForums and Breached.
A Chronology of Deception and Defiance
The timeline of van der Stap’s criminal career is punctuated by a rapid cycle of activity and legal intervention. Following his 2023 conviction and four-year sentencing—which included a period of voluntary detention for mental health treatment—van der Stap was released in December 2025. In subsequent months, he attempted to rebrand himself as a reformed industry professional, taking on a role as an offensive security lead at the firm Neo Security.
However, the silence from van der Stap in mid-September 2026 served as a precursor to his arrest on September 16. Sources familiar with the ongoing police investigation reported that authorities conducted a thorough search of his residence, seizing digital infrastructure and evidence that allegedly ties him to a February 2026 social engineering attack against Odido, the Netherlands’ largest mobile telecommunications provider. That breach resulted in the theft of personal information belonging to over 6.2 million Dutch citizens.
The Dutch police, who had previously released audio of the Odido perpetrator in a public appeal for information, appear to have made significant progress in identifying the voice. While ShinyHunters publicly defended their associate, pledging financial and legal support, the group’s rhetoric quickly turned hostile. They labeled the Dutch police as "incompetent" and "irrelevant," warning of further large-scale retaliatory strikes against the nation’s infrastructure.
The Escalation: FBI and Cl0p Targeted
The volatility of the ShinyHunters collective increased exponentially following the detention of van der Stap. In a move that signaled a departure from their previous operational methods, the group claimed responsibility for a breach of the FBI’s recruitment portal, apply.fbijobs.gov. The intrusion exposed the Social Security numbers and sensitive medical or psychiatric records of more than 5,000 FBI personnel, including special agents and cyber-threat investigators.
Security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that the group utilized a zero-day vulnerability in Oracle’s PeopleSoft platform, categorized as CVE-2026-35273. Despite Oracle’s rapid deployment of a patch and Mandiant’s issuance of web application firewall (WAF) mitigation rules, ShinyHunters successfully bypassed these defenses by employing advanced URL-encoding techniques.
Perhaps most notably, the group’s recent operations have expanded to include extortion attempts against the Russian ransomware syndicate Cl0p. This cross-pollination of cyber-gang warfare—attacking both the world’s most powerful law enforcement agency and a formidable rival ransomware group—suggests a transition in leadership. Intelligence sources indicate that a teenager from Amman, Jordan, known as "Rey," has assumed control of the group. Rey, who is reportedly associated with the hybrid collective "ScatteredLapsussHunters" (SLSH), is suspected of using the "Umbreon" persona—and the specific inclusion of Umbreon-themed ASCII art in their defacement messages—as a calculated effort to shift the blame for the FBI attack onto the incarcerated van der Stap.
Broader Implications and Institutional Vulnerability
The integration of supply-chain vulnerabilities, as seen in the exploitation of PeopleSoft, highlights a systemic risk for global enterprises. According to Mandiant researcher Austin Larsen, ShinyHunters is on a trajectory to generate nearly $100 million in extortion proceeds throughout 2026. This financial success is largely attributed to the group’s ability to monetize stolen credentials from smaller, less-equipped threat actors like TeamPCP, whose leaders were recently apprehended in Australia.
The situation has also created friction within the security community. The Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap previously volunteered, recently reported an internal security incident involving the malicious use of artificial intelligence. While the nonprofit has stated the incident does not appear linked to van der Stap or ShinyHunters, the coincidence has cast a spotlight on the ease with which bad actors can infiltrate legitimate security research organizations.
Official Responses and the Path Forward
The FBI has acknowledged the compromise of its job portal, though the full scope of the fallout remains under assessment. Assistant Director of the FBI’s Cyber Division, Brett Leatherman, issued a stern warning to the remnants of the ShinyHunters collective, emphasizing that the seizure of their infrastructure is providing investigators with a wealth of intelligence. "Arrests have a way of changing who is willing to talk," Leatherman stated, urging members to surrender before their identities are fully unmasked.
In the Netherlands, the situation has taken a darker turn. On September 29, reporting from the outlet RTL indicated that investigators have expanded their inquiry to include allegations that van der Stap may have attempted to orchestrate at least two murders abroad. This development, if proven, moves the investigation from the realm of digital theft into the domain of high-level violent crime, fundamentally altering the gravity of the case.
As the Rotterdam District Court prepares to hear the case, the broader cybersecurity industry is left to grapple with the reality of a threat landscape that is increasingly fluid. The case of Pepijn van der Stap serves as a stark reminder of the "Dr. Jekyll and Mr. Hyde" phenomenon in the digital age—where individuals with the skills to defend the world’s infrastructure often possess the knowledge to dismantle it from within. Whether the arrest of a single "Umbreon" will cripple a global syndicate or merely lead to its further radicalization under new leadership remains an open, and dangerous, question. The events of September 2026 demonstrate that as long as stolen data remains a high-value commodity, the nexus between talented individual hackers and decentralized criminal syndicates will continue to pose a formidable challenge to international law enforcement.
