In the high-stakes theater of global cybersecurity, the arrest of a single individual rarely slows the momentum of a major cybercriminal syndicate; instead, it frequently acts as a catalyst for chaotic retaliation. In September 2026, Dutch authorities apprehended 24-year-old Pepijn van der Stap—a previously convicted cybercriminal—on suspicion of orchestrating data thefts and digital extortions for the notorious hacking collective ShinyHunters.
Van der Stap’s detention triggered an immediate, aggressive escalation from the remaining members of ShinyHunters. Within days of the raid, the group launched a brazen attack on the Federal Bureau of Investigation’s (FBI) recruitment portal (apply.fbijobs.gov), exfiltrating sensitive personally identifiable information (PII)—including Social Security numbers and psychiatric records—pertaining to more than 5,000 agency personnel and cybercrime investigators. Concurrently, the group targeted Russian ransomware operators Cl0p, weaponizing Oracle PeopleSoft vulnerabilities, exploiting zero-day exploits, and bypassing enterprise-grade web application firewalls (WAFs) through advanced URL-encoding techniques.
This investigative report examines the dual life of Pepijn van der Stap—known in underground forums by his Pokémon-inspired alter ego, “Umbreon”—and his trajectory from a legitimate cybersecurity professional to a central figure in international cybercrime. Furthermore, this piece analyzes the structural shifts within ShinyHunters, the rise of teenage leadership under the banner of ScatteredLapsussHunters (SLSH), and the global fallout that has prompted high-level warnings from both the FBI and European law enforcement agencies.
Detailed Chronology
The "Dr. Jekyll and Mr. Hyde" Routine
The narrative of Pepijn van der Stap is emblematic of the blurred lines within the modern cybersecurity landscape, where elite technical talent often pivots fluidly between defensive engineering and malicious exploitation.
In late 2023, van der Stap stood trial in the Netherlands for a sweeping series of database thefts and extortion campaigns that Dutch prosecutors estimated generated between €1.5 million and €2.7 million in illicit proceeds. During the proceedings, van der Stap openly admitted to living a double life. By day, he operated as a skilled software engineer for the Amsterdam-based cybersecurity startup Hadrian and volunteered his technical expertise for the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research collective dedicated to identifying and mitigating systemic digital vulnerabilities.
By night, however, he assumed the hacker handle "Umbreon"—referencing the dark-type Pokémon character—and utilized English-language underground forums such as RaidForums and Breached to auction off massive proprietary databases.
Despite his confession, van der Stap was sentenced to four years in prison, with one year suspended. Preferring the controlled environment over freedom due to ongoing psychological challenges—including post-traumatic stress disorder (PTSD) stemming from childhood trauma—he initially opted to remain in custody before his eventual release in December 2025.
Rehabilitation and Sudden Disappearance
Following his release, van der Stap publicly worked to rehabilitate his public image. In an interview with security journalist Brian Krebs on September 9, 2026, he framed himself as a reformed individual committed to making amends. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm, while attempting to navigate ongoing civil litigation and restitution claims from his past victims.
However, this veneer of rehabilitation dissolved mid-September. After abruptly ceasing communication with journalists and associates, van der Stap was arrested by Dutch law enforcement on or around September 16, 2026. Witnesses reported seeing authorities removing hardware and property from his residence in Almere and Lelystad.
The investigation rapidly expanded beyond cyber extortion. On September 29, 2026, Dutch news outlet RTL reported that investigators expanded their inquiries to suspect van der Stap of attempting to orchestrate at least two contract murders abroad, indicating a chilling escalation in the gravity of the charges leveled against the 24-year-old.
The Odido Intrusion and Police Appeals
Van der Stap’s arrest was the culmination of a months-long dragnet by Dutch police, who had been actively seeking public assistance in identifying members of ShinyHunters. In February 2026, a native Dutch-speaking member of the group executed a sophisticated social engineering attack against Odido, the Netherlands’ largest mobile telecommunications provider.
Tricking an Odido employee into authenticating through a spoofed clone website, the threat actor breached internal systems and compromised personal records belonging to 6.2 million Dutch citizens. When Dutch law enforcement publicly released audio recordings of the social engineering phone call in September 2026, ShinyHunters readily acknowledged the suspect’s affiliation. In statements to the NL Times, the collective vowed emotional, mental, and financial support for their detained member, hiring a dedicated criminal defense attorney while dismissing the Dutch police as "incompetent, irrelevant, unimportant, and useless."
Supporting Context & Metrics
The Oracle PeopleSoft Zero-Day Campaign
The operational tempo of ShinyHunters shifted dramatically over the course of 2026. Security researchers from Mandiant and the Google Threat Intelligence Group (GTIG) documented a mass-exploitation campaign targeting Oracle PeopleSoft, a widely deployed enterprise software-as-a-service (SaaS) platform utilized for human resources, payroll, and benefits management.
CVE-2026-35273: Originally exploited as a zero-day vulnerability as early as June 2026, this flaw allowed remote attackers to bypass authentication controls and execute arbitrary code on internal enterprise applications.
WAF Bypass Techniques: Although Oracle issued emergency patches and Mandiant distributed mitigation rules for organizations unable to immediately update their environments, ShinyHunters evaded these defenses by employing advanced URL-encoding techniques.
Cross-Sector Impact: According to Mandiant’s threat intelligence reports, the campaign compromised dozens of corporate and institutional networks spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.
The FBI Jobs Site Breach
Capitalizing on the PeopleSoft vulnerability, ShinyHunters struck at the heart of American federal law enforcement. The group breached apply.fbijobs.gov, the official recruitment and job application portal for the FBI.
Data reviewed by cybersecurity journalists at 404 Media and Reuters revealed that the exfiltrated cache contained sensitive PII for over 5,000 current and prospective FBI personnel. The exposed records detailed specific job titles, security clearances, and operational divisions, including:
Special agents assigned to major cybercrime units.
Highly sensitive psychiatric and medical evaluation files required for federal security clearances.
Prominently featured within the defacement page left on the FBI portal was an ASCII art rendering of Umbreon, carrying the message: "This site has been seized by ShinyHunters. Rooting your systems since ’19 ;)."
Internal Strife: The Rise of "Rey" and SLSH
Security analysts tracking the underground ecosystem have noted a distinct fracture in the operational philosophy of ShinyHunters. Historically recognized for calculated data theft and targeted extortions, the syndicate’s recent aggressive posture—attacking the FBI and taunting the formidable Russian-speaking ransomware cartel Cl0p—stems from a hostile internal takeover.
Intelligence reports attribute this pivot to a teenage cybercriminal operating out of Amman, Jordan, known by the alias "Rey." Rey operates as a core administrator within ScatteredLapsussHunters (SLSH), a hybrid criminal collective fusing the operational tactics of Scattered Spider, LAPSUS$, and ShinyHunters.
According to industry sources, personal animosity existed between Rey and Pepijn van der Stap regarding control over the "ShinyHunters" brand equity and exfiltrated databases. Analysts suggest that the deliberate inclusion of the oversized Umbreon Pokémon imagery in the FBI job portal defacement was an intentional false-flag tactic engineered by Rey to implicate van der Stap further and deflect internal pressure.
Further compounding underground instability was a brief, disastrous partnership earlier in 2026 with TeamPCP, an emerging supply-chain hacking group that specialized in compromising software development pipelines. As revealed by investigative reporting in Wired, Mandiant covertly infiltrated TeamPCP’s infrastructure, neutralizing stolen credentials almost immediately by feeding them to major cloud providers like Amazon and Microsoft. When the stolen keys were rendered worthless, the allied syndicates turned on one another. ShinyHunters allegedly went rogue, monetizing credentials independently without distributing profits to their TeamPCP partners—a miscalculation that precipitated a wave of international arrests, including two alleged TeamPCP leaders detained in Australia in August 2026.
Despite these disruptions, threat intelligence firms estimate that ShinyHunters’ aggressive 2026 extortion spree places the syndicate on track to accumulate nearly $100 million in illicit payouts.
Official Statements
The global impact of the ShinyHunters campaign has triggered formal responses from major law enforcement and intelligence bodies.
Following the confirmation of the breach at apply.fbijobs.gov, the FBI released an official statement detailing the compromise of employee PII and outlining remediation steps for affected personnel. Concurrently, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, issued a stark video address directed squarely at the remaining members of ShinyHunters:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
In the Netherlands, the National Police formally confirmed the detention of the 24-year-old suspect linked to the Odido and ShinyHunters investigations, announcing that the individual would face preliminary hearings before the chambers of the Rotterdam District Court.
Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD) issued clarifications regarding an internal cybersecurity incident involving artificial intelligence tools. While confirming that the organization experienced an internal technical event, DIVD representatives stated definitively that the matter was unrelated to ShinyHunters and bore no connection to van der Stap’s historical volunteer tenure with the nonprofit.
Future Outlook
The convergence of corporate supply-chain exploitation, youthful underground syndicates like SLSH, and aggressive law enforcement coordination marks a critical inflection point in the cybercrime landscape.
The arrest of Pepijn van der Stap—and his subsequent exposure to severe criminal charges ranging from international data extortion to alleged murder solicitation—underscores the profound personal and legal perils facing modern cybercriminals who transition from underground forums to physical reality. Yet, as demonstrated by the immediate escalation of attacks following his detention, arresting individual operators rarely dismantles decentralized, highly resilient cybercrime networks.
As international agencies intensify cooperative cross-border operations, the remnants of ShinyHunters and their allied factions face mounting pressure. Whether the syndicate’s current leadership—typified by actors like Rey—can withstand coordinated global law enforcement pressure remains an open question. What is certain, however, is that the fallout from the PeopleSoft zero-day exploits, the FBI data breach, and the unraveling of the "Umbreon" persona will reverberate across the cybersecurity industry for years to come, fundamentally reshaping how organizations defend their supply chains against industrialized extortion.
