Introduction: A Dual Life Unraveled
The thin line between security researcher and cybercriminal has once again blurred, this time with dramatic consequences for international intelligence agencies and global security firms. Dutch authorities have confirmed the arrest of 24-year-old Pepijn van der Stap, a man whose digital footprint bridges the gap between legitimate cybersecurity consultancy and the shadowy, high-stakes world of the prolific hacker collective known as "ShinyHunters."
Van der Stap’s apprehension on September 16, 2026, has sent shockwaves through the dark web, triggering a violent escalation in cyber-attacks. Within days of his detention, the remaining members of ShinyHunters launched a series of brazen operations, including a breach of the FBI’s job application portal and a public extortion attempt against the notorious Russian ransomware syndicate, Cl0p. This article examines the rise and fall of Van der Stap, the internal power struggles within the ShinyHunters collective, and the implications of a new, more aggressive era of cyber warfare.
The Jekyll and Hyde Persona
Pepijn van der Stap, a resident of Almere and Lelystad, has long lived a life defined by paradoxes. To his professional peers, he was a talented software engineer and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit dedicated to securing the internet. By night, he operated under the alias "Umbreon"—a moniker derived from the Pokémon character—trafficking in stolen databases and extorting victims via platforms like the now-shuttered RaidForums and Breached.
In a 2023 trial, Van der Stap famously described his existence as a "Dr. Jekyll and Mr. Hyde" scenario. He was convicted in connection with a string of data thefts that prosecutors estimated netted between €1.5 million and €2.7 million. Despite his technical prowess, Van der Stap claimed his motivations were not purely financial. In interviews, he suggested that his hacking was driven by an obsessive-compulsive need to collect and organize massive datasets. "The hacking was very easy for me, and it wasn’t a compulsion," he told Bloomberg in 2024. "My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
Following his conviction, he served time in prison, during which he requested to remain in custody rather than return home, citing psychological struggles, including PTSD related to childhood trauma. He was released in December 2025, claiming he was a "reformed hacker" dedicated to making amends. At the time of his latest arrest, he was employed as an offensive security lead at the Amsterdam-based firm Neo Security.
Chronology of a Digital Collapse
The events leading to Van der Stap’s arrest were set in motion by a high-profile intrusion into Odido, the Netherlands’ largest mobile telecommunications provider. In February 2026, a native Dutch-speaking ShinyHunters member successfully social-engineered an Odido employee, leading to the theft of data belonging to over 6.2 million Dutch citizens.
- February 2026: ShinyHunters compromises Odido. Dutch police release audio clips of the social engineering call, asking the public for identification.
- September 9, 2026: Van der Stap grants an interview to KrebsOnSecurity, portraying himself as a man attempting to turn his life around.
- September 16, 2026: Dutch authorities arrest Van der Stap. Witnesses report police removing extensive hardware from his residence.
- September 17–20, 2026: ShinyHunters reacts with fury, escalating attacks globally.
- September 25, 2026: Mandiant and Google Threat Intelligence Group (GTIG) publish reports on the mass exploitation of an Oracle PeopleSoft vulnerability by ShinyHunters.
- September 29, 2026: Van der Stap is scheduled for a court appearance before the Rotterdam District Court.
The FBI Breach and the PeopleSoft Vulnerability
The most audacious move by ShinyHunters following Van der Stap’s arrest was the successful breach of the FBI’s job application portal, apply.fbijobs.gov. According to reports from 404 Media and Reuters, the hackers exfiltrated sensitive personal information, including Social Security numbers and psychiatric medical files of over 5,000 FBI officials.
This breach was achieved through the exploitation of CVE-2026-35273, a vulnerability in Oracle’s PeopleSoft software. While Oracle issued a patch, ShinyHunters demonstrated a sophisticated level of tactical adaptability. When Mandiant issued web application firewall (WAF) rules to mitigate the threat, the hackers utilized a URL-encoding trick to bypass the security measures. This campaign did not just target the FBI; it was a mass-exploitation effort affecting higher education, healthcare, and transportation sectors.
The "signature" left on the FBI portal was a pointed ASCII art design featuring an Umbreon Pokémon. Security analysts believe this was not merely a tribute to Van der Stap, but a calculated "frame-up" orchestrated by a new power player within the group.
The Rise of "Rey" and the SLSH Merger
The shift in ShinyHunters’ behavior—moving from opportunistic data theft to high-stakes political and intelligence-agency targeting—coincides with the influence of a teenage cybercriminal from Amman, Jordan, known as "Rey." Rey operates within an amalgamated group dubbed "ScatteredLapsussHunters" (SLSH), which combines the remnants of Scattered Spider, LAPSUS$, and ShinyHunters.
Sources close to the investigation suggest that Rey and Van der Stap had been locked in a power struggle over control of the ShinyHunters brand and its repository of stolen data. By leaving the Umbreon ASCII art at the scene of the FBI hack, Rey may have been attempting to solidify the connection between the Dutchman and the crime, essentially using Van der Stap as a sacrificial pawn to deflect heat from himself.
Rey’s history is well-documented by security firm KELA. Despite his youth, he has been linked to numerous ransomware attacks. Even after being approached for comment by security journalists, Rey’s digital volatility remained high; he taunted the FBI and Cl0p via social media using grotesque imagery, only to delete his accounts shortly after being contacted for comment regarding his father’s awareness of his activities.
Official Responses and Industry Implications
The Dutch police have been uncharacteristically vocal about the case. In a statement posted to X (formerly Twitter), the police confirmed the arrest of a 24-year-old and signaled that further information would be forthcoming. The Dutch authorities are currently under intense pressure to prove they can contain the "ShinyHunters" threat, especially after the group publicly mocked them, calling the police "incompetent, irrelevant, and useless."
Meanwhile, the cybersecurity community is grappling with the broader implications of the SLSH merger. The ability of these groups to pivot quickly—moving from supply-chain credential theft to the exploitation of enterprise software like PeopleSoft—suggests a new level of maturity in the cybercrime economy.
The DIVD, Van der Stap’s former volunteer organization, has also found itself in the crosshairs, recently reporting an internal security incident involving AI-driven malicious activity. While the organization maintains that this is unrelated to ShinyHunters or Van der Stap, the timing has raised eyebrows among security analysts who are watching for signs of further collateral damage from the group’s "scorched earth" strategy.
Conclusion: The End of an Era?
The arrest of Pepijn van der Stap serves as a grim reminder of the transient nature of digital anonymity. Whether he was a repentant researcher or a career criminal who simply grew too arrogant for his own good remains a matter of legal determination. However, the chaos that has followed his arrest suggests that the "ShinyHunters" collective is far from dismantled.
Under the leadership of figures like Rey, the group has evolved into a more dangerous, unpredictable entity. By attacking the FBI and challenging the very police forces tasked with their pursuit, these hackers are signaling a shift away from traditional cybercrime toward a model of aggressive, high-visibility disruption. For governments and corporations, the message is clear: the threat landscape has changed, and the "Umbreon" incident is likely only the beginning of a much larger, global confrontation.
