Authorities in the Netherlands have confirmed the arrest of a 24-year-old convicted cybercriminal, marking a significant development in the international investigation into the prolific and aggressive hacker collective known as ShinyHunters. The suspect, identified as Pepijn van der Stap, is being held on suspicion of facilitating data thefts and extortion schemes that have rattled both government agencies and major private-sector organizations. The arrest, which occurred in mid-September, has triggered a volatile reaction from the remaining members of ShinyHunters, who have responded with an unprecedented escalation in their cyber activities, including a high-profile breach of the Federal Bureau of Investigation (FBI) and the targeting of the Russian ransomware group Cl0p.
The Double Life of "Umbreon"
According to multiple sources with knowledge of the investigation, Pepijn van der Stap is a resident of Almere and Lelystad who has already navigated the Dutch legal system for his digital transgressions. In 2023, he was convicted for his role in a series of data thefts and extortion operations that prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds.
Van der Stap’s criminal career was defined by a stark contrast between his public persona and his clandestine activities. During his 2023 trial, he famously described his life as a "Dr. Jekyll and Mr. Hyde" existence. By day, he operated within the legitimate cybersecurity sector, working as a software engineer for the Amsterdam-based startup Hadrian and volunteering his time for the Dutch Institute for Vulnerability Disclosure (DIVD). However, under the cover of darkness, he assumed the hacker alias "Umbreon."
Using this handle, van der Stap extorted victims and trafficked stolen datasets on prominent English-language cybercrime forums, including the now-shuttered RaidForums and Breached. His arrest in 2023 led to a four-year prison sentence, with one year suspended. During the proceedings, he opted to remain in custody to receive treatment for psychological struggles, including PTSD linked to childhood trauma. He was eventually released in December 2025, attempting, by his own account, to pivot toward a reformed life as an offensive security lead at the Dutch firm Neo Security.
Escalation and the Odido Intrusion
The investigation into van der Stap gained renewed momentum as Dutch law enforcement ramped up efforts to identify the individuals behind a massive breach of Odido, the Netherlands’ largest mobile telecommunications provider. In February 2026, a Dutch-speaking member of ShinyHunters successfully social-engineered an Odido employee, tricking them into logging into a spoofed website. This breach resulted in the theft of personal data belonging to more than 6.2 million Dutch citizens.
Dutch authorities had been publicly circulating a recorded telephone call from that incident, hoping the public could identify the voice of the perpetrator. In a defiant response to the media, ShinyHunters confirmed the suspect in the recording was a member of their collective. In a statement provided to the NL Times, the group vowed to provide full support to their arrested colleague—emotionally, mentally, and financially—while labeling the Dutch police as "incompetent" and "irrelevant." The group explicitly warned that they would continue to carry out large-scale data thefts in the Netherlands until their associate was released.
A Brazen Pivot: Targeting the FBI and Cl0p
The intensity of the group’s operations shifted dramatically in the days following van der Stap’s latest arrest. ShinyHunters claimed credit for a breach of the FBI’s job application portal, apply.fbijobs.gov. According to reports from 404 Media and Reuters, the stolen data contained Social Security numbers and sensitive personal information on more than 5,000 FBI officials, including special agents and those tasked with investigating foreign state-backed cyber threats. The breach even included private psychiatric and medical files of Bureau staff.
Security researchers from Mandiant and the Google Threat Intelligence Group (GTIG) identified the method of entry: the exploitation of a PeopleSoft vulnerability (CVE-2026-35273). Despite Oracle issuing a patch and Mandiant providing firewall mitigation rules, ShinyHunters successfully bypassed these defenses using a URL-encoding trick. The group’s signature was unmistakable; the defacement image left on the FBI portal featured an ASCII art depiction of the Pokemon character Umbreon—a direct nod to van der Stap’s former alias—and a message mocking the agency.
Analysts suggest this shift toward high-risk, high-profile targets marks a departure from the group’s previous operational style. This pivot coincides with the reported ascendency of a teenage hacker from Amman, Jordan, known as "Rey," who leads a group called ScatteredLapsussHunters (SLSH). Sources indicate that Rey has been embroiled in a power struggle with van der Stap over the control of the ShinyHunters brand and its vast repository of stolen data. The inclusion of the "Umbreon" art on the FBI site is widely viewed as a tactical move by Rey to frame the Dutch suspect for the escalation.
The Dynamics of a Shifting Underworld
The tension between SLSH and the original ShinyHunters members stems from a failed partnership earlier this year. The groups had collaborated to monetize stolen credentials from "TeamPCP," a group that specialized in compromising software supply chains. However, the partnership soured after Mandiant researchers infiltrated TeamPCP and began burning the stolen credentials by alerting major cloud providers, rendering the data worthless. When the cooperating groups blamed one another for the loss of income, ShinyHunters reportedly went rogue, extorting victims using the stolen credentials without sharing the profits with their partners.
Despite these internal fractures, ShinyHunters has been remarkably lucrative. Mandiant researcher Austin Larsen estimated that the group is on track to extract nearly $100 million in extortion payments in 2026 alone. For van der Stap, however, the motivation appears to have been less about money and more about a compulsive desire to collect and organize data. "The hacking was very easy for me, and it wasn’t a compulsion," van der Stap told Bloomberg in 2024. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Legal Consequences and Ongoing Investigations
The situation surrounding van der Stap has become increasingly grave. While the Dutch police initially confirmed his arrest in connection with the ShinyHunters investigation, recent reports from the Dutch outlet RTL indicate that investigators are now probing allegations that van der Stap may have attempted to orchestrate at least two murders abroad.
As the legal proceedings unfold, the FBI has signaled its commitment to dismantling the group. In a public video message, Brett Leatherman, assistant director of the FBI’s cyber division, thanked Dutch authorities for their cooperation and extended a warning to the remaining members of ShinyHunters. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Van der Stap is expected to appear before the chambers of the Rotterdam District Court to face the mounting charges against him. As the dust settles on the recent wave of breaches, the international cybersecurity community remains on high alert, watching to see whether the arrest of one of the group’s most prominent figures will lead to the total collapse of the ShinyHunters collective or trigger further, even more desperate, acts of cyber aggression.
