The landscape of international cybersecurity was jolted when law enforcement authorities in the Netherlands announced the high-stakes arrest of a 24-year-old convicted cybercriminal suspected of playing a pivotal role in data thefts and extortion campaigns orchestrated by the prolific hacker collective known as ShinyHunters. The suspect, identified through multiple industry and legal sources as Pepijn van der Stap, was taken into custody in mid-September. The apprehension immediately triggered a wave of aggressive retaliatory actions from remaining members of the hacking syndicate, culminating in unprecedented breaches targeting the United States Federal Bureau of Investigation (FBI) and attempts to extort the notorious Russian ransomware operation Cl0p.
The arrest underscores the persistent threat posed by hybrid cybercriminals who bridge the gap between legitimate corporate software engineering and underground illicit enterprises. As global law enforcement agencies intensify cooperation to dismantle modern ransomware and data-extortion ecosystems, the fallout from van der Stap’s detention illustrates the volatile dynamics governing elite cybercrime syndicates and the increasingly brazen tactics they employ to challenge state authority.
Main Facts and Suspect Background
According to sources familiar with the ongoing multi-jurisdictional investigation, van der Stap was arrested on or around September 16, with Dutch police subsequently confirming the detention of a 24-year-old male slated to appear before the Rotterdam District Court. Investigators later revealed staggering additional allegations, with reports from Dutch media outlet RTL indicating that authorities suspect van der Stap of attempting to orchestrate at least two murders abroad.
Van der Stap is no stranger to law enforcement. In late 2023, he was convicted in the Netherlands for a string of data thefts and extortion schemes that prosecutors estimated generated between €1.5 million and €2.7 million. During his previous trial, van der Stap admitted to leading a double life. By day, he operated as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research group. By night, he adopted the hacker handle "Umbreon"—named after the Pokémon character—to extort victims and monetize stolen corporate databases on underground English-language hacking forums such as RaidForums and Breached.
Despite confessing to his crimes and receiving a four-year prison sentence—one year of which was suspended—van der Stap was released in December 2025. In subsequent media interviews, including discussions in September 2026, he cast himself as a reformed individual attempting to make amends while working as an offensive security lead for Dutch firm Neo Security. However, law enforcement and security analysts now believe his ties to the cybercriminal underworld remained active, culminating in his recent arrest and subsequent scrutiny by international intelligence agencies.
Chronology of Escalation and Retaliation
The timeline surrounding van der Stap’s arrest highlights a direct correlation between law enforcement interventions and aggressive retaliatory cyber assaults:
- February 2026: A native Dutch-speaking member of ShinyHunters uses social engineering to breach Odido, the Netherlands’ largest mobile telecommunications provider, stealing sensitive data belonging to more than 6.2 million individuals.
- Early September 2026: Dutch authorities launch public appeals, releasing a recorded telephone call to identify the voice behind the Odido breach. ShinyHunters publicly confirms the suspect is a member of their group, vowing full emotional and financial support while hurling insults at Dutch law enforcement.
- September 16, 2026: Dutch police execute a raid, arresting Pepijn van der Stap at his residence and seizing electronic equipment.
- Mid-September 2026: Following the arrest, remaining ShinyHunters operatives dramatically escalate their activities, executing a high-profile breach of the FBI job application portal (
apply.fbijobs.gov) and taunting the Cl0p ransomware syndicate. - September 25, 2026: Google Threat Intelligence Group and Mandiant publish reports detailing how ShinyHunters mass-exploited an Oracle PeopleSoft zero-day vulnerability (CVE-2026-35273) using URL-encoding bypass tricks.
- September 29, 2026: Dutch authorities confirm the suspect’s upcoming court appearance in Rotterdam, while investigative reports emerge regarding alleged murder-for-hire plots linked to the suspect.
The FBI Breach and Oracle PeopleSoft Vulnerabilities
The most alarming manifestation of ShinyHunters’ post-arrest retaliation was the brazen compromise of the FBI’s recruitment portal. According to independent security reporting by 404 Media and Reuters, the breach exposed Social Security numbers and personal identifiable information (PII) of more than 5,000 personnel, including special agents, threat intake examiners, and investigators tracking foreign state-sponsored cyber threats. Furthermore, the leaked documents included sensitive psychiatric and medical records of bureau staff.
Security researchers identified that the breach relied on the active exploitation of CVE-2026-35273, a vulnerability in Oracle’s PeopleSoft human resources and payroll platform. Although Oracle quickly issued patches and firms like Mandiant released web application firewall (WAF) mitigation rules, ShinyHunters bypassed defenses by employing sophisticated URL-encoding tricks. Google Threat Intelligence Group and Mandiant confirmed that the group used this PeopleSoft exploit to harvest data from dozens of organizations globally across healthcare, higher education, government, technology, agriculture, and transportation sectors.
Intriguingly, the defacement message left on the FBI jobs portal featured an ASCII art rendition of the Pokémon character Umbreon alongside the declaration: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Analysts note that this imagery directly invokes van der Stap’s former hacker handle, suggesting internal power struggles or deliberate attempts by rival faction leaders to frame the detained Dutch national.
Internal Power Struggles: The Rise of Rey and SLSH
Security analysts tracking the underground ecosystem point out that ShinyHunters’ pivot toward high-risk, high-profile targets like the FBI reflects a fundamental shift in leadership. Intelligence gathered by firms like KELA and Mandiant indicates that the group was recently co-opted by a teenage cybercriminal from Amman, Jordan, known by the alias "Rey." Rey operates within an amalgamated cybercrime syndicate dubbed ScatteredLapsussHunters (SLSH), which merges elements of notorious groups including Scattered Spider, LAPSUS$, and ShinyHunters.
Sources close to the investigation suggest that Rey harbored significant friction with van der Stap regarding control over the ShinyHunters brand and monetized data repositories. By embedding the Umbreon imagery into the FBI portal defacement, Rey may have sought to pin the blame squarely on the imprisoned Dutch hacker. Following media exposure, Rey’s primary social media presence was deleted, and his family members—including his father, an employee of Royal Jordanian Airlines—have largely declined to comment on the teenager’s alleged leadership role in global extortion campaigns.
This internal instability was further compounded by failed partnerships with upstream supply-chain hacking entities like TeamPCP, whose stolen credentials were rapidly burned by security firms such as Mandiant feeding keys directly to cloud providers like Amazon and Microsoft. Despite these setbacks, threat intelligence estimates project that ShinyHunters remains on track to extract nearly $100 million in extortion payments throughout 2026.
Official Responses and Broader Implications
International law enforcement agencies have adopted an increasingly coordinated and assertive posture in response to the escalation. In a video statement addressing the ongoing ShinyHunters investigation, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, commended Dutch law enforcement partners for their decisive action and directly warned remaining syndicate members.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
The implications of the van der Stap arrest and the subsequent ShinyHunters campaign extend far beyond a single criminal syndicate. The incident highlights the precarious security posture of widely deployed enterprise software platforms like Oracle PeopleSoft, where zero-day vulnerabilities can be weaponized at scale to compromise critical national security infrastructure. Moreover, the blending of geopolitical extortion, transnational teen-led hacker cells, and sophisticated cybercrime-as-a-service models demonstrates that modern cybersecurity requires unprecedented levels of cross-border intelligence sharing and proactive threat mitigation. As Dutch prosecutors prepare formal indictments and international courts review the evidence, the crackdown on ShinyHunters marks a critical turning point in the global effort to neutralize high-impact cyber extortion networks.
