Main Facts

The arrest of a 24-year-old Dutch cybercriminal by authorities in the Netherlands has catalyzed a violent escalation in international cyberwarfare, culminating in a brazen breach of the Federal Bureau of Investigation (FBI) and the targeting of notorious Russian ransomware syndicates.

The suspect, identified by multiple sources as Pepijn van der Stap—a previously convicted hacker from Almere and Lelystad who operated under the alias "Umbreon"—was taken into custody on or around September 16, 2026. Dutch police confirmed the apprehension of the 24-year-old individual in connection with an ongoing probe into the prolific extortion collective ShinyHunters.

Within days of van der Stap’s detention, remaining members of ShinyHunters launched a high-profile retaliation campaign. The gang compromised the FBI’s job application portal (apply.fbijobs.gov), leaking sensitive personally identifiable information (PII), Social Security numbers, and confidential medical and psychiatric records of over 5,000 FBI personnel. Simultaneously, the group launched aggressive extortion maneuvers against the Russian-speaking ransomware operation Cl0p, demonstrating a radical shift in operational tactics driven by internal leadership changes and bitter factional disputes.

Chronology of Events

The unfolding geopolitical and criminal narrative spans several years of dual-life cyber operations, leading up to the recent September 2026 crisis:

• 2021–2023: Pepijn van der Stap secretly operates under the alias "Umbreon," trading stolen databases containing millions of Dutch citizen records on underground English-language forums like RaidForums and Breached. Concurrently, he maintains a legitimate day job as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteers for the Dutch Institute for Vulnerability Disclosure (DIVD).
• Late 2023: Van der Stap is arrested, prosecuted, and convicted in the Netherlands for a string of data thefts and extortions yielding between €1.5 million and €2.7 million. He receives a four-year sentence (with one year suspended) and spends time in custody to manage psychological health challenges.
• December 2025: Van der Stap is released from prison, subsequently attempting to rebrand himself as a reformed security professional. By September 2026, he is employed as an offensive security lead at Neo Security.
• February 2026: A native Dutch-speaking ShinyHunters member social-engineers their way into Odido, the Netherlands’ largest mobile telecom provider, via a spoofed website, stealing data belonging to 6.2 million individuals. Dutch police launch a public audio appeal in September to identify the caller.
• September 9, 2026: Van der Stap grants an interview to KrebsOnSecurity, positioning himself as a reformed actor making amends through civil restitution. Shortly after, he abruptly ceases communication.
• September 16, 2026: Dutch law enforcement officers arrest van der Stap at his residence, confiscating physical hardware and digital devices.
• Mid-to-Late September 2026: ShinyHunters retaliates against the Dutch arrest by breaching the FBI jobs portal, utilizing an Oracle PeopleSoft zero-day vulnerability (CVE-2026-35273) and URL-encoding tricks to bypass Mandiant web application firewall (WAF) mitigations.
• September 25, 2026: Mandiant and the Google Threat Intelligence Group (GTIG) publish findings detailing ShinyHunters’ mass-exploitation campaign across global government, healthcare, and higher education sectors.
• September 29, 2026: Investigative reports from Dutch media outlet RTL reveal that investigators suspect van der Stap of attempting to orchestrate at least two murders abroad. Meanwhile, Dutch police confirm van der Stap is slated to appear before the Rotterdam District Court.

Supporting Data and Technical Architecture

The operational scope of the recent attacks highlights the sophistication of modern cybercrime syndicates and the supply-chain vulnerabilities they exploit.

The Oracle PeopleSoft Exploit Chain

ShinyHunters leveraged a critical flaw in Oracle’s PeopleSoft enterprise software-as-a-service platform (CVE-2026-35273), which organizations globally utilize for human resources, payroll, and recruitment. Although Oracle quickly patched the vulnerability—and security firms such as Mandiant released foundational WAF mitigation rules—ShinyHunters deployed advanced URL-encoding bypass techniques. These methods successfully skirted defensive perimeters, allowing the group to infiltrate dozens of high-value targets across agriculture, technology, transportation, healthcare, and higher education.

The "Umbreon" Fingerprint

The defacement page left behind on the compromised FBI job portal featured explicit markers linking the breach back to the arrested Dutch national. The intrusion screen displayed an ASCII art rendition of the Pokémon character Umbreon—van der Stap’s long-standing hacker handle—alongside the text: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)."

However, intelligence analysts note that this branding may have been weaponized. Sources close to the investigation suggest that a rival faction leader—a teenage cybercriminal from Amman, Jordan, known as "Rey," operating within the ScatteredLapsussHunters (SLSH) collective—intentionally embedded the Umbreon imagery to frame van der Stap amidst an ongoing internal dispute over control of the ShinyHunters brand and monetized databases.

Financial Projections and Supply Chain Collusion

According to threat intelligence assessments provided by Mandiant researcher Austin Larsen, ShinyHunters is on track to amass nearly $100 million in illicit extortion payments throughout 2026. This financial windfall follows a brief, unstable partnership earlier in the year with TeamPCP, a credential-harvesting supply-chain group whose leadership was dismantled following international arrests in Australia. The partnership fractured when ShinyHunters allegedly went rogue, monetizing stolen corporate credentials independently without sharing proceeds with their co-conspirators.

Official Responses

Law enforcement and corporate entities have responded aggressively to the escalating crisis:

• The Federal Bureau of Investigation (FBI): The agency acknowledged the security compromise of apply.fbijobs.gov, confirming that threat actors extracted sensitive personal data of roughly 5,000 employees. In a subsequent video address, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, thanked Dutch law enforcement partners and issued a direct warning to remaining members of ShinyHunters: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left… You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
• Dutch Law Enforcement: The National Police of the Netherlands confirmed the arrest of the 24-year-old suspect, scheduling his initial closed-chamber appearance before the Rotterdam District Court. Concurrently, police continue to analyze voice recordings from the February Odido telecommunications breach to tie physical identities directly to audio intercepts.
• ShinyHunters Collective: In public statements issued to regional media outlets like the NL Times, the hacker group adopted an aggressive, defiant posture. Dismissing the Dutch police as "incompetent" and "irrelevant," the collective vowed to financially and legally back their detained member while threatening further large-scale disruptions within the Netherlands.

Implications

The convergence of the van der Stap arrest, the FBI breach, and the rise of decentralized hybrid factions like ScatteredLapsussHunters carries profound implications for global cybersecurity posture:

1. Militarization of Extortion Groups: The shift from quiet data-hoarding—previously preferred by individuals like van der Stap, who viewed data collection as a psychological compulsion rather than a purely financial enterprise—to aggressive, high-risk geopolitical targeting indicates a dangerous maturation of cyber syndicates. By challenging state-level intelligence and law enforcement agencies directly, groups like ShinyHunters are inviting unprecedented cross-border crackdowns.
2. Internal Fractures as a Law Enforcement Asset: The friction between veteran hackers and aggressive new leadership cadres (such as the friction between Rey’s faction and European operators) creates critical intelligence-sharing vulnerabilities. As demonstrated by recent arrests in Australia, the Netherlands, and the Middle East, factional betrayals and intentional framing campaigns accelerate the erosion of criminal operational security.
3. Supply Chain Fragility: The persistence of zero-day exploits in enterprise tools like Oracle PeopleSoft demonstrates that corporate reliance on centralized SaaS human resources platforms remains an Achilles’ heel. Despite rapid patching cycles and advanced threat intelligence guardrails, sophisticated threat actors continue to weaponize evasion primitives to breach critical infrastructure and government agencies alike.