In a development that has sent shockwaves through the global cybersecurity landscape, Dutch law enforcement has arrested 24-year-old Pepijn van der Stap on suspicion of aiding data thefts and extortion campaigns orchestrated by the prolific cybercrime syndicate ShinyHunters.
Van der Stap—a convicted cybercriminal previously known in underground forums by the handle "Umbreon"—was detained in the Netherlands in mid-September 2026. Ironically, his arrest came just as he was attempting to rehabilitate his public image, having recently secured a position as an offensive security lead at Dutch firm Neo Security following a stint in prison.
The repercussions of van der Stap’s detention were immediate and explosive. Remaining factions of ShinyHunters launched an aggressive, high-profile counter-offensive. Within days of the arrest, the syndicate claimed credit for an unprecedented breach of the Federal Bureau of Investigation’s (FBI) recruitment portal (apply.fbijobs.gov), exposing the personally identifiable information (PII) and sensitive medical files of more than 5,000 personnel. Simultaneously, the group took aim at the Russian ransomware syndicate Cl0p, escalating inter-gang warfare in the cyber underground.
Adding a chilling dimension to the case, Dutch media outlets reported on September 29, 2026, that investigators now suspect van der Stap of attempting to orchestrate at least two murders abroad. As international agencies, including the FBI and Google Threat Intelligence Group (GTIG), scramble to mitigate the fallout, the arrest has exposed a chaotic power struggle within the upper echelons of the cybercrime underworld.
Chronology of Events
The unfolding crisis can be traced through a dense timeline of digital espionage, dual lives, and rapid-fire escalation:
September 2021: Operating under the pseudonym "Umbreon," van der Stap leaks a massive database containing information on 2.3 million Dutch citizens on the now-defunct cybercrime forum RaidForums.
Late 2023: Van der Stap is arrested and subsequently convicted in the Netherlands for a string of data thefts and extortions yielding between €1.5 million and €2.7 million. During his trial, he admits to leading a "Dr. Jekyll and Mr. Hyde" lifestyle—working legally as a software engineer by day for cybersecurity startup Hadrian and volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD), while extorting victims by night. He is sentenced to four years in prison.
December 2025: Van der Stap is released from prison early, later landing a job as an offensive security lead at Neo Security.
February 2026: A native Dutch-speaking ShinyHunters operative social-engineers their way into Odido, the Netherlands’ largest mobile telecommunications provider, stealing data on over 6.2 million individuals. Dutch police launch a public appeal to identify the voice in the call.
September 9, 2026: Van der Stap grants an interview to KrebsOnSecurity, portraying himself as a reformed hacker striving to make amends and pay civil restitution. Shortly after, he abruptly ceases all communication.
On or Around September 16, 2026: Dutch authorities arrest van der Stap. Witnesses report law enforcement removing hardware and files from his residence.
Mid-September 2026: In direct retaliation for the arrest, ShinyHunters breaches the FBI’s job application portal using a zero-day vulnerability in Oracle PeopleSoft (CVE-2026-35273). The hackers leave behind a mocking defacement banner featuring ASCII art of the Pokémon character Umbreon—a deliberate attempt by rival faction leaders to pin the attack on the detained Dutchman.
September 24–25, 2026: Google’s Mandiant and GTIG release reports confirming mass exploitation of Oracle PeopleSoft systems across multiple global industries. Meanwhile, ShinyHunters launches a wave of social media taunts targeting both the FBI and the Cl0p ransomware gang.
September 29, 2026: Dutch news outlet RTL breaks the revelation that investigators suspect van der Stap of ordering two contract murders to be carried out abroad. Van der Stap is scheduled to appear before the Rotterdam District Court. Concurrently, the FBI releases an official statement and video message from Cyber Division Assistant Director Brett Leatherman, urging remaining ShinyHunters members to surrender.
Supporting Data & Technical Infrastructure
The technical mechanics behind the 2026 ShinyHunters campaign reveal a sophisticated, highly adaptable adversary capable of bypassing advanced corporate defenses.
The Oracle PeopleSoft Vulnerability (CVE-2026-35273)
ShinyHunters leveraged an enterprise vulnerability in Oracle PeopleSoft—a widely adopted software-as-a-service platform utilized by corporations and government agencies for payroll, human resources, and hiring.
Zero-Day Exploitation: The group began utilizing the flaw in June 2026. While Oracle scrambled to patch the vulnerability, organizations slow to update relied on mitigating web application firewall (WAF) rules issued by security firm Mandiant.
WAF Bypass: In late September, security researchers discovered that ShinyHunters circumvented these protections using a clever URL-encoding trick, facilitating a mass-exploitation campaign across higher education, healthcare, technology, agriculture, transportation, and government sectors.
The Anatomy of the FBI Breach
The breach of apply.fbijobs.gov compromised high-level personnel data:
Victim Count: More than 5,000 individuals, including special agents, threat intake examiners, and investigators tracking foreign state-backed cyber threats.
Exfiltrated Data: Beyond basic contact information and Social Security numbers, internal documents reviewed by Reuters revealed that sensitive psychiatric and medical files of FBI staff were accessed and leaked.
The Underground Schism: SLSH and TeamPCP
Security analysts link the sudden volatility of ShinyHunters to a hostile takeover by a teenage Jordanian cybercriminal known as "Rey." Rey operates under the umbrella of ScatteredLapsussHunters (SLSH)—a fusion of infamous hacker groups Scattered Spider, LAPSUS$, and ShinyHunters.
The group had previously formed a brief, uneasy partnership with TeamPCP, a supply-chain hacking collective. However, after Mandiant covertly disrupted TeamPCP by feeding compromised credentials directly to cloud giants like Amazon and Microsoft, mutual paranoia set in. ShinyHunters allegedly went rogue, monetizing stolen credentials while freezing out their partners. This internal friction, coupled with Rey’s personal animosity toward van der Stap, culminated in the weaponization of the "Umbreon" persona to frame the Dutch hacker for the FBI compromise.
Official Responses and Law Enforcement Strategy
The international law enforcement community has responded to the escalation with a coordinated display of resolve.
The Dutch National Police: Following days of speculation, the Dutch police officially confirmed the arrest of the 24-year-old suspect. Authorities announced that van der Stap would face the chambers of the Rotterdam District Court to answer for his alleged role in data theft, extortion, and the newly uncovered murder-for-hire plot.
The Federal Bureau of Investigation: In a rare public video address, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, thanked Dutch law enforcement partners and directed a direct warning toward the remaining members of ShinyHunters.
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
The Corporate and Nonprofit Fallout: Oracle moved swiftly to release patches for the PeopleSoft flaws, while affected entities continue forensic audits. Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD)—van der Stap’s former volunteer organization—grappled with an internal cybersecurity incident involving AI misuse, though leadership confirmed the matter had no connection to ShinyHunters or their former volunteer.
Implications for Global Cybersecurity
The arrest of Pepijn van der Stap and the subsequent violent thrashing of ShinyHunters mark a watershed moment in the ongoing war between global law enforcement and decentralized cybercrime syndicates.
The Perils of the "Reformed Hacker" Narrative: Van der Stap’s trajectory highlights the complex challenge of reintegrating skilled technical talent. While many low-level cybercriminals successfully transition into legitimate defensive roles (often called "white hat" security), cases like van der Stap’s demonstrate that foundational compulsions—whether driven by a pathological urge to collect databases or unresolved psychological trauma—can pull individuals back into the criminal fold.
The Shift Toward State-Level Targets: Traditionally motivated by financial extortion, ShinyHunters’ pivot toward high-risk targets like the FBI signals a dangerous escalation. Under the erratic leadership of figures like Rey, modern cybercrime groups are increasingly willing to invite geopolitical retaliation, blurring the lines between financially motivated cyber extortion and state-sponsored espionage.
Cross-Border Collaboration as a Deterrent: The rapid cooperative takedown orchestrated between Dutch authorities and U.S. federal agencies proves that even sophisticated syndicates hiding behind aliases, VPNs, and decentralized structures remain vulnerable. As Leatherman noted, the arrest of a key node inevitably triggers a cascade effect, forcing accomplices into the open and dismantling the illusion of absolute digital anonymity.
By Azzam Bilal Chamdy 
Lina Irawan 
rifanmuazin 
Neng Nana 