Executive Overview
In a dramatic escalation of international cyber warfare, the arrest of a 24-year-old Dutch national in the Netherlands has triggered a wave of high-profile retaliatory attacks across the globe. The suspect, identified by multiple sources as Pepijn van der Stap—a previously convicted cybercriminal who operated under the hacker handle "Umbreon"—was taken into custody by Dutch authorities on suspicion of facilitating major data thefts and extortions for the prolific threat group ShinyHunters.
Within days of van der Stap’s detention, remaining members of ShinyHunters lashed out with unprecedented aggression. The cybercriminal syndicate launched a brazen assault on the Federal Bureau of Investigation (FBI), compromising its job application portal (apply.fbijobs.gov) and stealing sensitive personal identifiable information (PII), medical records, and security clearances of thousands of personnel. Simultaneously, the collective targeted the notorious Russian ransomware operation Cl0p, signaling a dangerous shift in the global threat landscape.
This deep investigative report examines the intersection of corporate espionage, internal gang betrayals, zero-day vulnerabilities in enterprise software, and the complex psychological profile of modern cybercriminals caught between institutional rehabilitation and criminal recidivism.
Detailed Chronology
1. The Jekyll and Hyde Routine: Pepijn van der Stap’s Rise and Fall
Pepijn van der Stap’s journey through the digital underground began years before his recent legal troubles. Originally from Almere and Lelystad in the Netherlands, van der Stap perfected a dual existence. By night, he operated under the alias "Umbreon"—a moniker inspired by the dark-type Pokémon character—extorting high-profile corporate victims and peddling stolen databases on English-language underground forums such as the now-defunct RaidForums and Breached.
By day, however, van der Stap presented himself as a legitimate security professional. He maintained employment as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, and volunteered his technical expertise with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization dedicated to uncovering and patching digital vulnerabilities.
In late 2023, van der Stap was prosecuted for his involvement in a sweeping wave of data thefts and extortions that Dutch prosecutors estimated netted between €1.5 million and €2.7 million. During his trial, he openly admitted to his crimes, citing underlying psychological struggles, including post-traumatic stress disorder (PTSD) stemming from childhood trauma. Opting to remain incarcerated voluntarily to access mental health support unavailable outside prison walls, van der Stap served time before his release in December 2025.
2. The Illusion of Rehabilitation and the September Arrest
Following his release, van der Stap sought to rebrand himself as a reformed hacker. In an interview with security journalist Brian Krebs on September 9, 2026, he spoke candidly about his desire to make amends, resolve ongoing civil lawsuits, and build a legitimate career. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm.
However, this veneer of rehabilitation proved short-lived. Shortly after the interview, van der Stap abruptly ceased all communications. On or around September 16, 2026, Dutch authorities swooped in, arresting van der Stap at his residence. Witnesses reported law enforcement officers carting out numerous electronic devices and hardware from his home.
By late September, the scope of the Dutch police investigation expanded dramatically. Reports from Dutch news outlet RTL revealed that investigators suspected van der Stap of orchestrating at least two contract murders abroad. As the legal noose tightened, the Rotterdam District Court scheduled a formal hearing for van der Stap, while international law enforcement agencies began connecting the dots between his network and the broader ShinyHunters enterprise.
3. The Odido Breach and the Voice That Betrayed the Gang
Months prior to van der Stap’s arrest, the Dutch national police had been tracking a sophisticated social engineering attack against Odido, the Netherlands’ largest mobile telecommunications provider. In February 2026, a native Dutch speaker successfully manipulated an Odido employee into authenticating against a spoofed phishing website. The subsequent breach compromised sensitive records belonging to more than 6.2 million Dutch citizens.
In September 2026, Dutch authorities released an intercepted audio recording of the social engineering call to the public, asking for help identifying the speaker. ShinyHunters brazenly confirmed that the voice belonged to one of their core operatives. In a public statement issued to the NL Times, the gang declared full emotional and financial support for their detained comrade, vowing to provide top-tier legal defense while mocking the competency of the Dutch police force as "incompetent, irrelevant, unimportant, and useless."
Supporting Context & Metrics
The Oracle PeopleSoft Zero-Day and the FBI Hack
The arrest of van der Stap served as the catalyst for ShinyHunters’ most provocative cyberattack to date. Days after the raid on the Dutch hacker’s home, ShinyHunters claimed responsibility for breaching the FBI’s recruitment portal, apply.fbijobs.gov.
Security reports from 404 Media and Reuters confirmed that the attackers exfiltrated Social Security numbers, job titles, specialized unit designations (including major cybercrime divisions and foreign counterintelligence details), and highly sensitive medical and psychological evaluation files belonging to more than 5,000 personnel.
The vector of attack relied on CVE-2026-35273, a critical vulnerability in Oracle PeopleSoft, a widely deployed enterprise resource planning (ERP) and human resources management platform. Although Oracle quickly issued an emergency patch, and Mandiant released protective web application firewall (WAF) mitigation rules, ShinyHunters utilized advanced URL-encoding techniques to bypass defenses. Joint reports from Google Threat Intelligence Group (GTIG) and Mandiant confirmed that the group executed a mass-exploitation campaign across multiple sectors, including government, healthcare, higher education, agriculture, and technology.
The Pokémon Signature and Internal Gang Strife
To mark their infiltration of the FBI network, ShinyHunters left a distinct calling card: a website defacement featuring ASCII art and a massive depiction of the Pokémon character Umbreon. The accompanying text read: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)."
While the use of the Umbreon imagery directly pointed to van der Stap’s historical hacker alias, cyber intelligence analysts believe the inclusion was an intentional setup. According to insider sources, leadership of the ShinyHunters brand had recently been usurped by a teenage cybercriminal from Amman, Jordan, known online as Rey. Rey operates as a core member of ScatteredLapsussHunters (SLSH)—a dangerous conglomerate merging operatives from Scattered Spider, LAPSUS$, and ShinyHunters.
Investigators suggest that Rey held a severe grudge against van der Stap over control of the ShinyHunters brand and infrastructure, weaponizing the FBI hack to publicly implicate the jailed Dutch hacker. Rey’s online persona aggressively taunted law enforcement and the rival Cl0p ransomware cartel on X (formerly Twitter) before deleting his accounts following media inquiries.
Supply-Chain Corruption and Financial Scale
The friction between SLSH and traditional ShinyHunters factions traces back to a short-lived partnership earlier in the year with TeamPCP, an emerging supply-chain hacking group that compromised global software repositories. As documented by Wired, Mandiant operatives successfully infiltrated TeamPCP’s infrastructure, neutralizing stolen credentials by quietly feeding them to cloud giants like Amazon and Microsoft.
While TeamPCP netted a meager $20,000 before its leadership was arrested in Australia, ShinyHunters allegedly went rogue, capitalizing on stolen credentials to orchestrate mass corporate extortions independently. According to Mandiant analyst Austin Larsen, these opportunistic campaigns have propelled ShinyHunters toward an estimated $100 million in total extortion revenue for 2026, marking a staggering monetization scale relative to historical cybercrime yields.
Official Statements
Law enforcement agencies across the Atlantic have responded with coordinated force, emphasizing that the dismantling of underground networks remains an international priority.
Brett Leatherman, Assistant Director of the FBI’s Cyber Division, released a direct video statement addressing the remaining members of ShinyHunters:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Meanwhile, the Dutch National Police formally confirmed the detention of the 24-year-old suspect via social media channels, announcing his impending appearance before the Rotterdam District Court to face multiple felony charges related to data theft, extortion, and conspiracy.
Future Outlook
The convergence of institutional arrests, internal gang betrayals, and state-sponsored retaliation signals a profound inflection point in the cybercrime ecosystem.
- Increased Law Enforcement Pressure: The successful cooperation between European cybercrime units and U.S. federal agencies demonstrates that digital borders offer diminishing protection for transnational syndicates. As infrastructure is seized and core members turn informants, the operational security (OpSec) of groups like SLSH and ShinyHunters is rapidly deteriorating.
- Retaliatory Volatility: Rather than suppressing cybercriminal activity, high-profile arrests are increasingly triggering scorched-earth retaliation campaigns. As evidenced by the FBI portal compromise, cornered threat actors are willing to risk severe geopolitical backlash to project power and intimidate investigators.
- Enterprise Hardening: The weaponization of supply-chain platforms like Oracle PeopleSoft underscores the urgent necessity for organizations to accelerate zero-day patch cycles, implement robust application shielding, and move beyond standard WAF mitigations to counter adaptive evasion techniques.
Ultimately, the downfall of Pepijn van der Stap and the chaos surrounding the leadership of ShinyHunters illustrate that while the digital underworld is infinitely adaptable, it remains inherently fragile—vulnerable to human ego, internal betrayal, and the relentless pressure of global intelligence operations.
