Main Facts

In a sprawling international cybercrime saga that bridges Dutch law enforcement, global ransomware syndicates, and the United States federal government, authorities in the Netherlands have arrested 24-year-old convicted cybercriminal Pepijn van der Stap. Van der Stap—widely known in underground forums by his hacker handle “Umbreon”—is suspected of aiding and orchestrating data thefts and extortion campaigns on behalf of the prolific cybercrime collective ShinyHunters.

The arrest, executed on or around September 16, 2026, has triggered a violent and desperate escalation across the digital underworld. Within days of van der Stap’s detention, remaining factions of ShinyHunters launched high-profile retaliatory attacks. These included a brazen breach of the FBI’s job application portal (apply.fbijobs.gov), which exposed the sensitive personal identifiable information (PII)—including Social Security numbers, job titles, and psychiatric and medical files—of more than 5,000 Bureau personnel. Simultaneously, the syndicate engaged in a bitter digital war with the Russian-speaking ransomware group Cl0p, weaponizing zero-day exploits on a massive global scale.

Security researchers estimate that ShinyHunters is on track to extract nearly $100 million in extortion payments throughout 2026 alone. Behind this unprecedented financial and operational pivot lies an internal coup: the alleged takeover of the group by a teenage Jordanian cybercriminal operating under the alias “Rey,” a core member of the ScatteredLapsussHunters (SLSH) collective.

Chronology of Events

The narrative arc of this international cybersecurity crisis spans years of double lives, high-stakes infiltration, and an explosive September 2026 escalation.

• September 2021: Operating under the Pokémon-themed moniker “Umbreon,” van der Stap leaks and sells databases on underground forums like RaidForums, offering information on millions of citizens, including a database covering 2.3 million Dutch nationals.
• Late 2023: Van der Stap is arrested and subsequently convicted in the Netherlands for a string of data thefts and extortions that prosecutors value between €1.5 million and €2.7 million. At trial, he confesses, revealing a "Dr. Jekyll and Mr. Hyde" lifestyle: by night, he was an underground extortionist; by day, a software engineer at Amsterdam cybersecurity startup Hadrian and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD).
• December 2025: Van der Stap is released from prison after serving a sentence that included time held by choice for psychological and trauma-related treatments.
• February 2026: A native Dutch-speaking member of ShinyHunters social-engineers their way into Odido, the Netherlands’ largest mobile telecommunications provider, via a spoofed website. This breach compromises the data of over 6.2 million Dutch citizens. Dutch police subsequently launch a public appeal to identify the voice in the call.
• June 2026: ShinyHunters begins mass-exploiting a critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft, an enterprise resource planning platform widely utilized for human resources and payroll operations across global industries.
• September 9, 2026: Van der Stap grants an interview to KrebsOnSecurity, portraying himself as a fully reformed hacker attempting to make amends and work legitimately as an offensive security lead at Dutch firm Neo Security. Shortly after, he abruptly stops answering communications.
• September 16, 2026: Dutch authorities officially detain van der Stap. Witnesses report police removing equipment from his residence.
• Mid-to-Late September 2026: Following van der Stap’s arrest, ShinyHunters launches a wave of aggressive retaliatory cyberattacks. The group defaces the FBI’s job application portal using ASCII art of the Pokémon character Umbreon, mocking law enforcement and taunting the Cl0p ransomware group.
• September 25, 2026: Google’s Mandiant and Threat Intelligence Group release reports detailing how ShinyHunters bypassed web application firewall (WAF) mitigations using URL-encoding tricks to exploit PeopleSoft installations across government, healthcare, and higher education sectors.
• September 29, 2026: Dutch media outlet RTL reveals that investigators suspect van der Stap attempted to orchestrate at least two contract murders abroad, dramatically deepening the severity of the charges he faces. The Dutch police confirm that van der Stap is scheduled to appear before the Rotterdam District Court.

Supporting Data

The operational mechanics of the recent attacks showcase a high degree of technical sophistication, intersecting with complex human dynamics and intelligence tracking.

The Oracle PeopleSoft Zero-Day Campaign

The backbone of ShinyHunters’ 2026 extortion spree relies on the systemic exploitation of CVE-2026-35273, a flaw in Oracle’s PeopleSoft framework.

• Initial Mitigation Bypasses: Although Oracle patched the vulnerability and Mandiant released defensive WAF rules, telemetry gathered by security researchers revealed that ShinyHunters bypassed these blocks using advanced URL-encoding manipulation.
• Cross-Sector Impact: The campaign impacted dozens of enterprise networks spanning technology, agriculture, transportation, higher education, healthcare, and government entities.

The FBI Portal Compromise

The breach of apply.fbijobs.gov yielded data targeting individuals in high-risk national security roles.

• Targeted Personnel: Compromised files included information on special agents, threat intake examiners, and personnel assigned to major cybercrimes and foreign state-backed threat units.
• Exfiltrated Files: Beyond basic PII and Social Security numbers, threat actors accessed sensitive internal medical and psychiatric files submitted during the federal vetting process.

Financial and Internal Syndicate Metrics

• Extortion Revenue: According to Mandiant researcher Austin Larsen, ShinyHunters is on pace to capture nearly $100 million in extortion payouts over the course of 2026.
• The SLSH Coalition: The internal hostile takeover of ShinyHunters by the teenage Jordanian administrator known as "Rey" marks a convergence of actors from notorious groups Scattered Spider, LAPSUS$, and ShinyHunters under the umbrella of ScatteredLapsussHunters (SLSH).

Official Responses

Law enforcement agencies and corporate entities have responded to the escalating crisis with coordinated statements and security briefings.

• The FBI Cyber Division: Assistant Director Brett Leatherman issued a public video statement expressing gratitude to Dutch law enforcement partners. Directly addressing the remaining members of ShinyHunters, Leatherman warned, "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you."
• Dutch National Police: Confirming the detention of the 24-year-old suspect, police officials outlined plans for formal judicial proceedings at the Rotterdam District Court, while continuing public appeals regarding the Odido data breach audio recordings.
• ShinyHunters’ Public Stance: In statements given to regional media like the NL Times, the syndicate dismissed the capabilities of European law enforcement while vowing emotional, mental, and financial backing—including legal representation—for their arrested personnel. Their rhetoric towards the Dutch police characterized them as "incompetent" and "useless."
• Corporate Reactions: Oracle acted swiftly to issue emergency security updates for the PeopleSoft platform following zero-day disclosures, while affected entities like the FBI confirmed ongoing remediation efforts in coordination with cybersecurity oversight bodies.

Implications

The cascading events surrounding the arrest of Pepijn van der Stap and the violent resurgence of ShinyHunters carry profound implications for the future of international cybersecurity and cybercrime enforcement.

1. The Perils of "Rehabilitation" in Tech: Van der Stap’s trajectory—moving from a convicted database hoarder to a legitimate startup engineer and offensive security lead, only to be thrust back into the criminal spotlight—highlights the profound vulnerabilities within the cybersecurity hiring pipeline. Organizations face mounting pressure to deeply vet personnel who possess dual fluency in offensive exploitation and defensive engineering.
2. The Shift to Aggressive State Targeting: Traditionally, criminal syndicates avoided targeting federal law enforcement agencies like the FBI due to the inevitability of total retaliatory mobilization. ShinyHunters’ willingness to breach federal recruitment portals and openly taunt state intelligence apparatuses signals a dangerous crossing of the Rubicon, where high-profile ego and inter-gang power struggles outweigh self-preservation.
3. The Rise of Decentralized Youth Factions: The consolidation of power by teenage administrators like "Rey" demonstrates that modern cybercrime syndicates are increasingly resilient, decentralized, and driven by digital natives who operate across complex geopolitical fault lines. Traditional extradition and policing frameworks struggle to seamlessly counter actors embedded in cross-continental coalitions like SLSH.
4. Supply Chain Fragility: The weaponization of enterprise supply chain tools like Oracle PeopleSoft underlines a grim reality: vulnerabilities in foundational human resources and administrative software remain an Achilles’ heel for global infrastructure, capable of simultaneously compromising private enterprise and national security apparatuses in a single stroke.