The landscape of international cybersecurity was jolted this month following a high-stakes series of law enforcement actions in the Netherlands, subsequent rapid-fire retaliatory cyberattacks, and startling new allegations involving transnational cyber syndicates. Dutch authorities have officially confirmed the arrest of a 24-year-old convicted cybercriminal suspected of providing vital assistance to the prolific, internationally feared hacker collective known as ShinyHunters. The suspect has been identified by multiple independent sources as Pepijn van der Stap, a Dutch national whose cybercriminal alter ego, "Umbreon," once dominated underground forums before he transitioned into legitimate security roles.
The arrest, executed on or around September 16, 2026, served as a catalyst for immediate, aggressive retaliation. Within days of van der Stap’s detention, remaining operatives operating under the ShinyHunters banner launched a wave of audacious digital incursions. These retaliatory measures included a brazen data breach targeting the Federal Bureau of Investigation’s recruitment portal and the extortion of the notorious Russian-speaking ransomware enterprise, Cl0p. The unfolding crisis highlights the volatile nexus between European law enforcement agencies, state-backed cyber threats, and decentralized, highly combative global hacker organizations.
Chronology and Background of the Investigation
The roots of the current operation trace back through years of escalating digital crime, cross-border intelligence sharing, and public appeals by European law enforcement. Pepijn van der Stap, a resident of Almere and Lelystad, has a well-documented history within the cyber underground. In late 2023, he stood trial in the Netherlands for a string of data thefts and extortion schemes that prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds.
During his 2023 trial, van der Stap offered a candid depiction of a dual existence. By night, he operated under the handle "Umbreon," infiltrating corporate networks, extorting vulnerable targets, and hawking proprietary databases on English-language cybercrime communities such as RaidForums and Breached. By day, however, he maintained a respectable professional profile as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, while simultaneously volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization dedicated to uncovering and remediating software flaws.
Van der Stap confessed to his crimes and received a four-year prison sentence, of which one year was suspended. During legal proceedings, he opted to remain in custody rather than serve pre-trial detention at home, citing a need for treatment related to psychological issues, including post-traumatic stress disorder stemming from childhood trauma. Following his release in December 2025, van der Stap sought to publicly recast his narrative. In interviews, including one with security journalists on September 9, 2026, he presented himself as a reformed individual striving to make positive societal contributions. At the time of his recent arrest, he was employed as an offensive security lead at Neo Security, a Dutch security firm.
Despite these rehabilitation efforts, Dutch investigators maintained a relentless focus on unmasking the individuals responsible for a devastating February 2026 cyberattack against Odido, the Netherlands’ largest mobile telecommunications provider. In that intrusion, ShinyHunters utilized sophisticated social engineering tactics, tricking an Odido employee into authenticating credentials on a spoofed website. The breach compromised the sensitive personal data of more than 6.2 million Dutch citizens. In September 2026, Dutch police took the rare step of releasing a recorded telephone call to the public, asking for help identifying the native Dutch-speaking operative behind the Odido scam. Media inquiries prompted ShinyHunters to confirm that the voice belonged to a core member of their collective, vowing full emotional, mental, and financial support for the detained individual while hurling insults at Dutch law enforcement capabilities.
The Escalation: FBI Job Portal and Cl0p Extortion
The detention of van der Stap triggered an immediate and dramatic shift in ShinyHunters’ operational tempo. Rather than retreating, the remaining members embarked on a campaign of high-risk, high-profile attacks designed to demonstrate defiance and retaliate against institutional adversaries.
Just days after van der Stap’s apprehension, ShinyHunters claimed responsibility for an extraordinary intrusion into apply.fbijobs.gov, the official job application portal for the Federal Bureau of Investigation. According to forensic findings and independent reporting by outlets such as 404 Media and Reuters, the breach exposed Social Security numbers and deeply personal records belonging to more than 5,000 current and former FBI personnel. The compromised datasets detailed specialized assignments, including special agents, threat intake examiners, and personnel dedicated to tracking major cybercrimes and foreign state-sponsored cyber threats. Furthermore, the leaked documents included sensitive medical and psychiatric evaluations of agency staff.
The FBI subsequently issued a public statement acknowledging the compromise of the recruitment portal. According to cybersecurity analysts at Mandiant and the Google Threat Intelligence Group (GTIG), the vector for this breach and numerous other corporate intrusions was the widespread exploitation of a zero-day vulnerability (tracked as CVE-2026-35273) in PeopleSoft, an enterprise human resources and payroll platform developed by Oracle. Although Oracle moved quickly to issue a security patch after the flaw was discovered in June, and security vendors published web application firewall (WAF) mitigation rules, ShinyHunters demonstrated sophisticated evasion techniques. Using URL-encoding tricks, the group successfully bypassed defensive WAF rules to mass-exploit the PeopleSoft vulnerability across multiple critical sectors, including government, healthcare, higher education, technology, and transportation.
Cryptic signatures left within the FBI job portal defacement directly referenced van der Stap’s former cybercriminal moniker. The hackers plastered an ASCII art rendering of the Pokémon character Umbreon across the seized portal alongside the message, "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Security experts noted that this exact imagery mirrored a defacement style the group utilized during previous historical attacks, signaling an ongoing internal power struggle or an intentional effort to pin the high-stakes FBI breach directly on the imprisoned Dutch hacker.
Leadership Shifts and Internal Fractures within the Cyber Underground
Intelligence analysts closely monitoring the inner workings of elite cybercriminal organizations suggest that the recent, aggressive pivot in ShinyHunters’ tactics stems from a fundamental restructuring of its leadership. For years, the collective operated with a degree of measured calculation regarding which targets to pursue. However, sources familiar with the matter indicate that the group experienced a hostile takeover orchestrated by a teenage cybercriminal from Amman, Jordan.
Operating under the handle "Rey," this individual is a prominent figure within an amalgamated cybercrime syndicate known as ScatteredLapsussHunters (SLSH)—a coalition uniting remnants of notorious groups including Scattered Spider, LAPSUS$, and ShinyHunters. Rey was publicly unmasked by cybersecurity firm KELA in March 2025. Investigations reveal that deep-seated animosity existed between Rey and van der Stap regarding control over the ShinyHunters brand, infrastructure, and accumulated data troves. Analysts assess that Rey’s prominent display of the Umbreon Pokémon imagery during the FBI website defacement was calculated to shift federal scrutiny and direct blame onto the freshly arrested Dutch operative.
The volatility within these cybercrime networks has been further exacerbated by botched partnerships and intelligence agency infiltrations. Earlier in 2026, ShinyHunters briefly aligned with TeamPCP, an upstart gang specializing in software supply chain compromises. However, unbeknownst to the criminals, Mandiant researchers had deeply infiltrated TeamPCP’s operations. Secretly feeding stolen enterprise credentials directly to major cloud providers like Amazon and Microsoft, security teams ensured that compromised access keys were invalidated almost as quickly as they were stolen.
This rapid burning of stolen credentials fostered extreme paranoia and finger-pointing among the allied hacker factions. According to reports by Wired, ShinyHunters eventually went rogue, utilizing TeamPCP’s harvested credentials to execute independent extortions without cutting in their supply-chain partners. Despite these internal frictions, threat intelligence firms estimate that ShinyHunters’ aggressive extortion campaigns have positioned the group to generate nearly $100 million in illicit payouts throughout 2026.
Expanding Legal Peril and International Implications
The legal net surrounding the investigation continues to tighten across multiple jurisdictions. Following the initial confirmation of a 24-year-old suspect’s arrest, the Rotterdam District Court scheduled preliminary hearings to address the formal charges against van der Stap. In a stunning escalation of the case, Dutch news outlet RTL reported on September 29, 2026, that investigators are probing allegations that van der Stap attempted to orchestrate at least two contract murders overseas, indicating that his criminal enterprise may have extended far beyond digital data theft and extortion.
Meanwhile, international law enforcement agencies have signaled a unified, aggressive stance against the collective. Brett Leatherman, Assistant Director of the FBI’s Cyber Division, released a video statement explicitly addressing the remaining members of ShinyHunters. Acknowledging the vital assistance provided by Dutch law enforcement partners, Leatherman issued a stern warning to the fugitive hackers: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
The dismantling of portions of the ShinyHunters infrastructure and the arrest of foundational members like van der Stap underscore both the successes and the persistent vulnerabilities of modern cybersecurity defense. While international cooperation between agencies like the FBI and Dutch police continues to yield high-value arrests, the rapid evolution and retaliation capabilities of decentralized syndicates like SLSH demonstrate that the threat landscape remains profoundly volatile. As judicial proceedings advance in Rotterdam and intelligence agencies pore over seized digital assets, the fallout from the ShinyHunters campaign is expected to shape international cyber policy and enforcement strategies for years to come.
