Executive Overview
The arrest of 24-year-old Dutch cybercriminal Pepijn van der Stap in mid-September 2026 has sent seismic shockwaves through the global cybersecurity landscape. Van der Stap, previously convicted in 2023 for orchestrating a sprawling web of data thefts and extortions, was taken into custody by Dutch law enforcement under suspicion of aiding the notorious, high-impact hacker collective known as ShinyHunters.
Rather than subduing the syndicate, Van der Stap’s detention acted as a powder keg. Within days, remaining members of ShinyHunters and affiliated factions launched an unprecedented wave of retaliation and opportunistic cyberattacks. The fallout included a brazen breach of the Federal Bureau of Investigation’s (FBI) job application portal (apply.fbijobs.gov), the targeted extortion of the Russian-speaking ransomware syndicate Cl0p, and a high-stakes turf war driven by a teenage hacker kingpin operating out of Amman, Jordan.
This deep dive unpacks the dual life of Pepijn van der Stap—operating under the alias "Umbreon"—the mechanics of the Oracle PeopleSoft exploitation campaign, the geopolitical fallout of the FBI breach, and the turbulent internal power struggles fracturing modern cybercrime syndicates.
Detailed Chronology
The Jekyll-and-Hyde Hacker of Almere
Pepijn van der Stap’s journey into the dark underbelly of cybercrime began long before his initial arrest. By day, Van der Stap presented himself as a legitimate, contributing member of the cybersecurity ecosystem. Working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian and volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD), he cultivated a veneer of respectability.
By night, however, Van der Stap operated under the handle "Umbreon"—a moniker styled after the Pokémon character that would later reappear as a persistent digital signature in high-profile breaches. Using English-language cybercrime forums such as RaidForums and Breached, Umbreon trafficked in stolen databases, leaking massive caches of personal information (PII) belonging to millions of citizens across Europe.
Following an extensive investigation, Dutch prosecutors caught up with Van der Stap, revealing that his illicit enterprises had generated between €1.5 million and €2.7 million. At his trial in late 2023, Van der Stap offered a candid confession, admitting to a "Dr. Jekyll and Mr. Hyde" existence driven less by financial greed and more by an obsessive compulsion to collect, organize, and archive stolen data. He was sentenced to four years in prison, with one year suspended.
Citing severe psychological distress and childhood trauma resulting in PTSD, Van der Stap initially opted to remain in custody rather than seek early release, claiming better access to care inside the correctional system. He was ultimately released in December 2025.
Rehabilitation Claims vs. Reality
In interviews conducted as recently as September 9, 2026, Van der Stap painted a picture of a reformed individual desperately attempting to make amends. Serving as an offensive security lead at the Dutch firm Neo Security, he claimed to be cooperating with civil lawsuits, paying restitution to victims, and trying to steer his technical expertise toward defensive measures.
However, this narrative abruptly unraveled in mid-September. After ceasing all communication with journalists and associates, Van der Stap was arrested by Dutch authorities on or around September 16, 2026. Witnesses reported law enforcement personnel removing multiple items of digital evidence from his residence.
Subsequent developments added a dark, chilling dimension to the case. By late September, investigative reports from Dutch outlet RTL revealed that authorities were expanding their inquiries to include suspicions that Van der Stap had attempted to orchestrate at least two murders abroad.
The Odido Intrusion and ShinyHunters’ Retaliation
Long before Van der Stap’s September arrest, Dutch authorities had been circling ShinyHunters regarding a major security breach at Odido, the Netherlands’ largest mobile telecommunications provider. In February 2026, a native Dutch speaker social-engineered an Odido employee into authenticating against a spoofed phishing domain. The attackers leveraged this foothold to exfiltrate personal data belonging to more than 6.2 million Dutch citizens.
In an unusual public appeal, Dutch police released an audio recording of the social-engineering phone call, asking the public for help in identifying the perpetrator’s voice. ShinyHunters quickly claimed ownership of the audio clip, confirming that the suspect was indeed a core member of their collective. In statements given to the NL Times, the group promised total emotional, mental, and financial support for their detained member, even retaining a dedicated criminal defense attorney.
Simultaneously, ShinyHunters unleashed a torrent of abuse directed at Dutch law enforcement, dismissing them as "incompetent, irrelevant, unimportant, and useless," while boasting that the police would need divine intervention to prevent further major attacks on Dutch soil.
Supporting Context & Metrics
The Oracle PeopleSoft Zero-Day Campaign
The escalation of ShinyHunters’ operations extended far beyond rhetorical threats. In June 2026, the group began actively exploiting a critical vulnerability (CVE-2026-35273) in PeopleSoft, an enterprise resource planning and human resources management platform developed by Oracle.
While Oracle scrambled to issue emergency patches, and security firms like Mandiant rushed to deploy web application firewall (WAF) mitigation rules, ShinyHunters proved resilient. According to a September 25 joint report by Mandiant and the Google Threat Intelligence Group (GTIG), the hackers bypassed mitigation controls using sophisticated URL-encoding tricks. This mass-exploitation campaign compromised dozens of corporate, governmental, educational, and healthcare systems globally.
The FBI Job Portal Breach
The most high-profile casualty of the PeopleSoft exploitation campaign was the FBI’s job application portal, apply.fbijobs.gov.
Working in tandem with reports from 404 Media and Reuters, investigators confirmed that ShinyHunters exfiltrated highly sensitive records detailing over 5,000 FBI personnel. The breached datasets included:
- Social Security numbers and personal contact information.
- Specific operational team assignments, including special agents, threat intake examiners, and personnel assigned to major cybercrimes and foreign state-backed threat units.
- Confidential psychiatric and medical evaluation records of FBI employees.
Left in the wake of the breach was a digital calling card: a defacement banner featuring ASCII art of the Pokémon character Umbreon alongside the taunting message: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)."
The Ascent of "Rey" and the SLSH Fracture
Security researchers note that the aggressive, high-risk strategy of targeting the FBI and extorting the Russian ransomware group Cl0p represents a radical shift from ShinyHunters’ traditional operational playbook. This volatility is attributed to a hostile leadership takeover by a teenage Jordanian cybercriminal known as "Rey."
Operating out of Amman, Rey serves as a prominent administrator within ScatteredLapsussHunters (SLSH)—a cybercrime conglomerate formed via the convergence of remnants from Scattered Spider, LAPSUS$, and ShinyHunters. Publicly unmasked by threat intelligence firm KELA in March 2025, Rey reportedly harbored a deep-seated grudge against Pepijn van der Stap over the control of the ShinyHunters brand and its lucrative data repositories.
According to intelligence sources, the prominent inclusion of the Umbreon Pokémon branding in the FBI portal defacement was not an accidental tribute, but a deliberate psychological ploy by Rey to pin the high-profile federal crime directly on the incarcerated Dutchman.
Official Statements
Law enforcement and intelligence agencies have responded to the escalating crisis with coordinated warnings and direct appeals:
-
Brett Leatherman, Assistant Director of the FBI’s Cyber Division: In a video message released following the arrests and infrastructure seizures, Leatherman commended Dutch law enforcement partners and delivered a direct ultimatum to remaining members of ShinyHunters:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
-
Dutch National Police: Confirming the arrest of the 24-year-old suspect linked to the ShinyHunters investigation, police spokespersons announced that the individual would face preliminary hearings before the chambers of the Rotterdam District Court to address multiple felony counts relating to unauthorized access, extortion, and associated organized crime charges.
-
ShinyHunters Collective: In public statements to European media outlets, the collective doubled down on defiance, asserting institutional loyalty to their detained operatives while dismissing international law enforcement efforts as completely ineffective.
Future Outlook
The convergence of state-sponsored cyber espionage tactics, youth-driven cybercrime syndicates (SLSH), and vulnerable enterprise software supply chains (Oracle PeopleSoft) marks a dangerous inflection point in digital security.
As of late September 2026, the global threat landscape is characterized by extreme volatility:
- Intensified Law Enforcement Pressure: Following the coordinated takedowns in the Netherlands and Australia (targeting the allied supply-chain group TeamPCP), international police cooperation is yielding actionable intelligence at an accelerated pace. However, decentralized syndicates continue to adapt by fracturing into smaller, more aggressive cells.
- The Evolution of Extortion: With threat intelligence estimates suggesting ShinyHunters is on track to pull in close to $100 million in illicit extortion proceeds for 2026, traditional enterprise backup strategies are proving insufficient. Attackers are shifting their focus toward psychological manipulation, regulatory exposure, and personal targeting of corporate and governmental employees.
- Internal Syndicate Discord: The ideological and territorial clashes between legacy members (such as the jailed Pepijn van der Stap) and radicalized youth leadership (such as Rey and the SLSH coalition) suggest that internal betrayal may ultimately prove to be the most effective vulnerability exploited by global law enforcement agencies.
The coming months will test the resilience of global cybersecurity defenses as intelligence agencies race to dismantle the remaining infrastructure of ShinyHunters before retaliatory campaigns can be launched against Western critical infrastructure.
