Arrest of Former Hacker in ShinyHunters Probe
Dutch police have arrested 24-year-old Pepijn van der Stap on suspicion of aiding data thefts and extortions carried out by the hacker group ShinyHunters. Van der Stap, from Almere and Lelystad in the Netherlands, was taken into custody on or around September 16, 2026, and has remained in detention for questioning since. Authorities confirmed his identity through multiple sources familiar with the investigation.
Van der Stap has a prior criminal record, having been convicted in late 2023 for a series of data thefts and extortions that prosecutors stated generated between €1.5 million and €2.7 million in illicit proceeds. During his trial, he admitted to operating under the hacker alias "Umbreon," using the name to steal and leak data from victims while posting on defunct forums such as RaidForums and Breached. His avatar on these platforms featured the Pokémon character Umbreon.
By day, van der Stap worked as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization focused on responsible security research. He was sentenced to four years in prison, with one year suspended, and elected to remain in custody during part of his sentence due to psychological challenges, including PTSD linked to childhood trauma. He was released from prison in December 2025.
Post-Release Activities and Interview Claims
Following his release, van der Stap positioned himself as a reformed hacker seeking to contribute positively to society. In an interview with KrebsOnSecurity on September 9, 2026, he stated he was working as an offensive security lead at Neo Security, a Dutch company, and was attempting to make amends for past actions through civil restitution and cooperation with victims. He acknowledged ongoing legal and financial obligations tied to his earlier cybercrimes.
However, shortly after the interview, van der Stap ceased responding to messages. Associates reported being unable to contact him for two weeks prior to his arrest, and efforts by those close to him to reestablish contact were unsuccessful.
ShinyHunters Escalates Attacks After Arrest
In the days following van der Stap’s detention, ShinyHunters intensified its operations, launching high-profile attacks that marked a significant escalation in the group’s activity. The collective claimed responsibility for breaching the FBI’s job application portal at apply.fbijobs.gov, compromising personal data of over 5,000 U.S. government officials.
The stolen information included Social Security numbers, job titles, team affiliations, and sensitive psychiatric and medical records of FBI employees, including those working in cybercrime and counterintelligence units targeting foreign state-backed actors. The FBI confirmed the breach in a brief statement, while ShinyHunters asserted access was gained through exploitation of a recently patched vulnerability in Oracle’s PeopleSoft platform.
Exploitation of CVE-2026-35273 and Evasion Tactics
ShinyHunters exploited CVE-2026-35273, a zero-day flaw in PeopleSoft that began being actively abused in June 2026 before Oracle issued a patch. Mandiant had previously released web application firewall (WAF) rules to help organizations defend against the threat while awaiting updates. However, BleepingComputer reported that ShinyHunters bypassed these protections using a URL-encoding technique to evade detection.
A joint report released on September 25, 2026, by Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that the group had mass-exploited the vulnerability across dozens of systems in sectors including higher education, technology, healthcare, agriculture, transportation, and government.
Symbolic Use of Umbreon in FBI Defacement
Investigators noted that the defacement page left on the FBI jobs site contained ASCII art of the Pokémon character Umbreon — van der Stap’s former alias — accompanied by the message: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)" This imagery matched a similar defacement used by ShinyHunters in their 2020 intrusion of the Hackforums community.
Security analysts suggested the inclusion of the Umbreon symbol may have been an attempt by a rival faction within the group to frame van der Stap for the attack, particularly amid internal conflict over control of the ShinyHunters brand and stolen data.
Internal Conflict and Leadership Shift in ShinyHunters
Multiple sources indicated that the recent aggressive tactics by ShinyHunters coincided with a leadership shift, whereby the group came under the influence of a teenage cybercriminal from Amman, Jordan known as "Rey." Rey is associated with ScatteredLapsussHunters (SLSH), a coalition believed to merge elements of Scattered Spider, LAPSUS$, and ShinyHunters.
Rey was first identified by KELA in March 2025. Prior attempts to interview him through his father, an employee of Royal Jordanian Airlines, were unsuccessful, with the father declining to comment and Rey deleting his Twitter/X account shortly after media inquiries intensified. Sources said Rey harbored resentment toward van der Stap over disputes regarding control of the group’s operations and assets.
Background on Group Rivalry and Monetization Disputes
Tensions between ShinyHunters and SLSH reportedly stemmed from a brief collaboration earlier in 2026 with TeamPCP, a group focused on compromising global software supply chains. Although TeamPCP succeeded in stealing credentials, it struggled to monetize the data. Mandiant was later found to have secretly invalidated the stolen credentials by feeding them to major cloud providers like Amazon and Microsoft, rendering them useless.
According to reporting by Wired’s Andy Greenberg, ShinyHunters subsequently broke from the partnership, using TeamPCP’s credentials for extortion without sharing profits with the original developers. This action reportedly triggered accusations of betrayal between the groups. Mandiant researcher Austin Larsen told KrebsOnSecurity that ShinyHunters had conducted a successful extortion campaign in 2026, projecting nearly $100 million in payments from victims.
Van der Stap’s Motivations and DIVD Update
Despite the financial scale of ShinyHunters’ operations, van der Stap has maintained that his early hacking was not financially motivated. In a 2024 interview with Bloomberg, he described his behavior as driven by a compulsion to collect and organize data, stating: "The hacking was very easy for me, and it wasn’t a compulsion. My habit was collecting. Collecting data, organizing data, downloading data, creating folders."
In a separate development, DIVD disclosed via LinkedIn that it had experienced an internal cybersecurity incident involving the malicious use of artificial intelligence. A spokesperson told KrebsOnSecurity that the incident does not appear connected to ShinyHunters, nor does it involve any current or former volunteers, including van der Stap.
Source: Krebs on Security