Dutch Police Arrest Convicted Hacker Pepijn van der Stap Amid Escalating ShinyHunters Attacks

Dutch Police Arrest Convicted Hacker Pepijn van der Stap Amid Escalating ShinyHunters Attacks Dutch authorities have arrested 24-year-old convicted cybercriminal Pepijn van der Stap in connection with data thefts and extortions by the ShinyHunters gang, an event quickly followed by brazen retaliatory attacks against the FBI and rival cybercriminals. Pepijn van der Stap, known previously by the alias Umbreon, was arrested in the Netherlands on suspicion of supporting ShinyHunters operations and reportedly faces allegations of ordering two murders abroad. Following Van der Stap's arrest, ShinyHunters claimed responsibility for breaching the FBI's hiring portal by exploiting an Oracle PeopleSoft vulnerability, compromising records on more than 5,000 personnel. The FBI breach site displayed defacement art referencing the Umbreon handle, which sources link to an internal leadership dispute involving a Jordanian hacker known as Rey. ShinyHunters has intensified operations across multiple sectors in 2026, including the compromise of 6.2 million customer records from Dutch telecommunications provider Odido. Arrest and Prior Criminal History Dutch law enforcement detained 24-year-old Pepijn van der Stap around mid-September, with Dutch broadcaster RTL reporting that investigators also suspect him of ordering two murders abroad. Van der Stap had previously been convicted in 2023 for extortion and data theft under the alias Umbreon, serving prison time until December 2025. Despite claiming rehabilitation and taking an offensive security role at Neo Security, Van der Stap fell out of contact shortly before his arrest. The arrest follows an ongoing investigation into a February 2026 breach of Dutch telecom Odido, where a Dutch-speaking ShinyHunters operative tricked an employee into granting system access that exposed data belonging to 6.2 million people. Exploitation of the FBI Jobs Portal Days after Van der Stap was taken into custody, ShinyHunters breached the FBI's job portal, apply.fbijobs.gov. The intrusion exposed Social Security numbers, medical information, and job classifications for over 5,000 individuals, including special agents and foreign threat cyber investigators. The group carried out the attack by leveraging CVE-2026-35273, a vulnerability in Oracle's PeopleSoft platform, using a URL-encoding technique to bypass web application firewall rules recommended by Mandiant. Security researchers at Mandiant and Google Threat Intelligence confirmed that ShinyHunters launched mass-exploitation campaigns using this vulnerability against numerous organizations in transportation, healthcare, government, and higher education. Internal Leadership Clashes and Framing The FBI breach site prominently displayed ASCII art of the Pokemon Umbreon, a marker associated with Van der Stap's past activity. Sources close to the investigation state that ShinyHunters has recently been led by an Amman-based teenager known as Rey, operating through an umbrella entity known as ScatteredLapsussHunters. Investigators believe the use of the Umbreon imagery during the FBI defacement and subsequent public taunting of both the FBI and the Russian ransomware gang Cl0p were deliberate attempts by Rey to pin high-profile attacks on Van der Stap following a feud over operational control. Criminal Disputes and Escalating Extortions The broader friction surrounding ShinyHunters stems partly from broken partnerships with other cybercrime groups. Earlier in the year, ShinyHunters and partner hackers worked with the supply-chain group TeamPCP to monetize stolen credentials. After Mandiant infiltrated TeamPCP and shared the compromised keys with cloud providers for invalidation, ShinyHunters allegedly broke off cooperation and extorted targets independently without sharing proceeds. Despite these internal tensions, Mandiant analysts noted that ShinyHunters' aggressive extortion operations have put the collective on track to collect nearly $100 million in illicit payments across 2026.

荷兰警方逮捕黑客组织ShinyHunters关联嫌疑人，团伙随后攻击FBI 荷兰当局逮捕了24岁的定罪网络犯罪分子佩平·范德斯塔普（Pepijn van der Stap），怀疑其协助黑客组织ShinyHunters进行数据盗窃和勒索。在范德斯塔普被捕后，该团伙袭击了美国联邦调查局（FBI）招聘网站并勒索俄罗斯勒索软件组织Cl0p，同时内部派系纷争与涉嫌买凶杀人的案情也随之曝光。 荷兰警方于9月中旬逮捕了曾化名“Umbreon”的24岁黑客佩平·范德斯塔普，指控其协助ShinyHunters团伙犯罪。 ShinyHunters随后利用Oracle PeopleSoft漏洞攻破FBI招聘网站，窃取了5,000多名官员的社保号、职位及敏感医疗记录。 知情人士透露，ShinyHunters目前被约旦青少年黑客“Rey”接管，其在针对FBI的攻击中故意使用范德斯塔普的标志性符号试图嫁祸。 荷兰媒体披露，调查人员还怀疑范德斯塔普曾涉嫌在境外策划至少两起谋杀案。 嫌疑人被捕与“双面”经历 消息人士指出，荷兰当局在9月16日左右逮捕了佩平·范德斯塔普。他曾于2023年因系列数据盗窃被判处四年监禁（一年缓刑），涉案金额达150万至270万欧元，并于2025年12月出狱。范德斯塔普曾在审判中承认自己过着双重生活：白天是安全初创企业的软件工程师并担任DIVD志愿者，暗中则化名“Umbreon”在黑客论坛勒索受害者并发布数据。尽管他在2026年9月受访时自称已改过自新，但不久后便失去联系并被警方拘留。 ShinyHunters报复并入侵FBI网站 在范德斯塔普被拘留数天后，ShinyHunters入侵了FBI的求职门户网站。媒体报道称，被盗数据包含5,000多名FBI工作人员的敏感信息，涵盖特工、网络犯罪调查员的敏感职务、社保号以及精神和医疗档案。黑客组织通过利用Oracle PeopleSoft平台中近期修补的漏洞（CVE-2026-35273）实施了大规模攻击，并通过URL编码技巧绕过了相关网络应用防火墙规则。Mandiant与谷歌威胁情报小组证实，该团伙已利用该漏洞攻击了全球数十个系统。 团伙内部冲突与领导层更迭 调查消息人士透露，ShinyHunters近期的大胆举动源于该组织领导层的变动。该团伙已被来自约旦安曼的青少年黑客“Rey”接管，Rey同时运作黑客联合体ScatteredLapsussHunters（SLSH）。知情人士称，Rey与范德斯塔普在组织品牌和数据控制权上存在矛盾，FBI遭篡改页面中留下的“Umbreon”宝可梦图像很可能是Rey试图栽赃范德斯塔普的举动。此外，该团伙与其他黑客组织因数据转卖利益分赃不均也积累了诸多内部矛盾。 官方警告与买凶杀人指控 荷兰警方已证实逮捕了一名24岁男子，该嫌疑人将被送往鹿特丹地方法院受审。荷兰媒体RTL随后报道称，调查人员怀疑范德斯塔普曾指使在境外实施至少两起谋杀。针对这一系列事件，FBI网络部门助理局长发表视频声明，对荷兰警方的协助表示感谢，并警告ShinyHunters剩余成员尽快自首，直言执法部门正在掌握留存成员的行踪。

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group **ShinyHunters**. In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the **FBI** and extorting the Russian ransomware group **Cl0p**. According to three sources familiar with the matter, the Dutch man arrested by authorities this month is **Pepijn van der Stap**, a convicted cybercriminal from Almere and Lelystad in the Netherlands. Van der Stap was previously convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. At his trial in late 2023, van der Stap admitted that he lived a Dr. Jekyll and Mr. Hyde existence, secretly using the hacker handle “**Umbreon**” to extort victims and post their data on English language hacking communities like the now-defunct RaidForums and Breached. By day, however, van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup **Hadrian**, while volunteering at the **Dutch Institute for Vulnerability Disclosure** (DIVD), a nonprofit security research group. Van der Stap confessed to his data theft and extortion activity, and was sentenced to four years in prison (one of which was suspended). During his trial, van der Stap opted to remain in custody for a time rather than at home, saying he could not find better treatment on the outside for his ongoing psychological issues, which he claimed included PTSD related to childhood trauma. He was released from prison in December 2025. In an interview with KrebsOnSecurity on September 9, 2026, Van der Stap cast himself as a reformed hacker who was trying to turn his life around and make a positive contribution to society. Van der Stap is currently employed as offensive security lead at the Dutch company **Neo Security**, which did not respond to requests for comment. Van der Stap said he was still dealing with civil lawsuits and restitution related to his previous cybercrime victims, and that he was trying his best to make amends. But not long after that interview, the Dutch hacker abruptly stopped replying to messages. Efforts by others close to him also repeatedly failed to elicit a response for the past two weeks. According to two sources with knowledge of the matter, Van der Stap was arrested by Dutch authorities on or around September 16, and has been held in custody for questioning since. One source said a colleague of theirs personally witnessed Dutch authorities carting items out of Van der Stap’s residence. Authorities in the Netherlands have been [asking the public for help](https://www.politie.nl/nieuws/2026/september/7/11-stem-van-verdachte-odido-hack-te-horen-in-opsporing-verzocht.html) in identifying the voice in a recorded telephone call from February 2026 in which a native Dutch-speaking ShinyHunters member social engineered their way into **Odido**, the nation’s largest mobile telecommunications provider. In that intrusion, ShinyHunters tricked an Odido employee into logging in at a spoofed website, and then used that access to steal data on more than 6.2 million Dutch people. Responding to Dutch news media, ShinyHunters confirmed that the suspect in the audio clip is indeed a member of the hacker collective. “Our team member has our full support – emotionally, mentally, and financially,” the hackers said. “Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them,” reads a statement ShinyHunters shared with [NL Times](https://nltimes.nl/2026/09/08/shinyhunters-lawyer-police-release-audio-clip-suspect-odido-hack). It remains unclear if the Dutch police have matched the Odido caller to a confirmed real-life identity. The Dutch police unit handling the Odido incident did not respond to requests for comment. The group also lashed out at the authorities in the Netherlands. “The Dutch police will need all the luck in the world – and everyone’s prayers – if they want to catch him before we carry out another large-scale data theft in the Netherlands,” the ShinyHunters statement said. “Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless.” Just days after sources say Van der Stap was detained by Dutch authorities, ShinyHunters claimed credit for an unusually brazen breach at the FBI’s job application site apply.fbijobs.gov. According to [reporting from 404 Media](https://archive.is/IQgWr), the data stolen from the FBI site includes Social Security numbers and [personal information](https://www.bbc.com/news/articles/cw62me2vlj07o) on more than 5,000 officials. 404 Media and [Reuters reported](https://archive.is/IQgWr) the FBI data included each person’s job title or team, such as special agent, threat intake examiner, major cybercrimes unit, and those investigating cyber threats from foreign state-backed actors. Reuters examined documents shared by ShinyHunters and found they included sensitive psychiatric and medical files of FBI staff. The FBI issued [a brief statement](https://www.fbi.gov/news/press-releases/fbi-statement-on-compromise-of-fbijobsgov-portal-and-alleged-impact-to-fbi-employee-pii?utm_campaign=email-Immediate&utm_medium=email&utm_source=national-press-releases&utm_content=%5B2249041%5D-%2Fnews%2Fpress-releases%2Ffbi-statement-on-compromise-of-fbijobsgov-portal-and-alleged-impact-to-fbi-employee-pii) confirming the hack. ShinyHunters said it gained access to the FBI site and other victims by exploiting a recently patched vulnerability (CVE-2026-35273) in **PeopleSoft**, a software-as-a-service platform from the software giant **Oracle** that is broadly used by companies to manage hiring and human resources, benefits and payroll. Oracle quickly issued a fix for the Peoplesoft vulnerability that ShinyHunters reportedly began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations who couldn’t apply the security update quickly enough. But on Friday, BleepingComputer reported that ShinyHunters [used a URL-encoding trick](https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/) to bypass Mandiant’s suggested web application firewall rules designed to mitigate the threat from the PeopleSoft flaw. In [a report](https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft) released Sept. 25, security experts at **Mandiant** and the **Google Threat Intelligence Group** (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government. Van der Stap’s former hacker alias Umbreon was hidden in plain sight throughout the imagery ShinyHunters used to spread news about the FBI hack: The defacement image that ShinyHunters left behind on the hacked FBI jobs site included an ASCII art design featuring the Pokemon character Umbreon. The message at the top read, “This site has been seized by ShinyHunters. rooting your systems since ’19 ;)” The image appears identical to a defacement message ShinyHunters used in their [2020 hack](https://reliaquest.com/blog/the-eeveelution-of-shinyhunters-from-data-leaks-to-extortions/) of the English-language cybercrime community Hackforums. Multiple sources close to the ShinyHunters investigation said the group’s recent risky attacks against the FBI and one of Russia’s most venerated ransomware groups amounted to a major pivot away from the more measured tenor of the hacking gang’s operations. Those sources said the sudden shift came about after ShinyHunters was taken over by [a teenage cybercriminal from Amman, Jordan](https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/) who goes by the nickname **Rey** and operates as part of a cybercrime group called **ScatteredLapsussHunters** (SLSH), which experts say is an amalgamation of three hacking groups — [**Scattered Spider**](https://krebsonsecurity.com/?s=scattered+spider), [**LAPSUS$**](https://krebsonsecurity.com/?s=lapsus%24) and [**ShinyHunters**](https://krebsonsecurity.com/?s=shiny+hunters). Those sources said Rey had an ongoing beef with the Dutch hacker over control of the ShinyHunters brand and data, and that the inclusion of the oversized Umbreon Pokemon image in the FBI jobs site defacement was likely an attempt by Rey to pin the hack on the Dutchman. Rey was [first publicly identified](https://www.kelacyber.com/blog/hellcat-hacking-group-unmasked-rey-and-pryx/) by the cybersecurity firm **KELA** in March 2025. In advance of our [November 2025 profile of Rey](https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/), KrebsOnSecurity messaged Rey’s father and asked for permission to interview his teenage son. Rey’s dad merely forwarded the message to his son, who admitted to participating in ransomware attacks and said he was trying to extricate himself from the SLSH hacker group. Immediately after news of the FBI jobs site hack was picked up in the media, Rey’s main account on Twitter/X (Ryan Moran/@rmoskovy) was taunting the Cl0p ransomware group and the FBI, crudely depicting them as the twin towers in New York being struck by planes labeled “cl0p drama” and “fbi breach claim.” In the foreground of the city is the giant Pokemon figure of Umbreon. On Sept. 24, KrebsOnSecurity again contacted Rey’s dad, asking to interview him and his son for a story on Rey’s apparent ascendency as the head of ShinyHunters. Just hours after that request, Rey deleted his longtime Twitter/X account. Meanwhile, Rey’s dad, who works for the Royal Jordanian Airlines, has failed to respond to a half-dozen emailed requests for comment about his son’s alleged activities. Where does the bad blood between SLSH and ShinyHunters come from? According to [a story in Wired](https://www.wired.com/story/an-undercover-google-analyst-infiltrated-a-notorious-supply-chain-hacking-gang/) this month, ShinyHunters and SLSH members briefly partnered earlier this year to help better monetize important stolen credentials collected by **TeamPCP**, an upstart group that was having great success compromising global code supply chains with malicious software but hadn’t been able to profit much from their stolen data (two alleged leaders of TeamPCP [were arrested last month in Australia](https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/), and in an interview the TeamPCP leader claimed they made just $20,000). The Wired story noted how Mandiant had infiltrated TeamPCP and was secretly responsible for having the crime group’s stolen credentials burned so quickly: Mandiant was secretly feeding those credentials to the major cloud providers like Amazon and Microsoft, who quickly invalidated the stolen keys. Meanwhile, the formerly cooperating hacker groups began to blame one another for causing the credentials to become worthless. Wired’s **Andy Greenberg** reported that a few weeks after partnering with TeamPCP, “ShinyHunters went rogue, carrying out its own extortions with TeamPCP’s credentials but without giving the supply-chain hackers their cut.” Mandiant researcher **Austin Larsen** told KrebsOnSecurity earlier this month that ShinyHunters has been enjoying a successful extortion spree so far this year, and is on track to pull in nearly $100 million in extortion payments from cybercrime victims in 2026. Van der Stap claims he was never motivated by money and that his earlier hacker activity was driven by a desire to have the world’s most complete collection of stolen databases. Speaking with reporters from Bloomberg in 2024, Van der Stap said that singular focus in turn fueled his desire to carry out cyberattacks. “The hacking was very easy for me, and it wasn’t a compulsion,” he [told Bloomberg](https://archive.ph/K47wB#selection-1447.0-1447.321). “My habit was collecting. Collecting data, organizing data, downloading data, creating folders.” DIVD, the nonprofit security research group where Van der Stap previously served as a volunteer, [disclosed on LinkedIn last week](https://www.linkedin.com/feed/update/urn:li:activity:7508986131779088384/) that the organization was dealing with an internal cybersecurity incident that appears to have involved the malicious use of artificial intelligence. DIVD has released few details about that incident, but a spokesperson for the nonprofit told KrebsOnSecurity it does not appear related to ShinyHunters, nor are there any signs the matter involves the work of a previous volunteer. **Update: 3:44 p.m. ET:** Corrected Van der Stap’s age, which is 24 (not 23). **Update, 4:54 p.m. ET:** The Dutch police have confirmed the arrest of a 24-year-old in connection with the ShinyHunters investigation. In [a statement on Twitter/X](https://x.com/Pol_Ops_Int/status/2104607979559342174), the Dutch police said the man will appear on Tuesday, September 29 before the chambers of the Rotterdam District Court, and that it will provide more information tomorrow. **Sept. 29, 9:42 a.m. ET:** The Dutch news outlet **RTL** [reports](https://www.rtl.nl/nieuws/binnenland/artikel/5656154/pepijn-van-der-s-verdacht-van-opdracht-geven-moorden) that investigators suspect Van der Stap tried to orchestrate at least two murders. RTL reported the two murders were allegedly to be committed abroad, and that there are indications the suspect gave the order for this. The FBI released [a short video message](https://x.com/FBICyberDiv/status/2104923994801553646?s=46) on the ShinyHunters investigation from Brett Leatherman, assistant director of the FBI’s cyber division, who thanked Dutch law enforcement partners for their assistance and urged remaining ShinyHunters members to turn themselves in. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” Leatherman said. “The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours.”