Dutch Police Arrest ‘Reformed’ Hacker in ShinyHunters Probe

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal suspected of helping the prolific ShinyHunters group carry out data thefts and extortions. According to three sources, the man is Pepijn van der Stap of Almere and Lelystad.

He was already convicted in 2023 over a string of thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. At trial he admitted living a Dr. Jekyll and Mr. Hyde existence: under the handle "Umbreon" he extorted victims and posted their data on forums such as the now-defunct RaidForums and Breached, while by day working as an engineer at the startup Hadrian and volunteering at the nonprofit DIVD.

He was sentenced to four years (one suspended) and released in December 2025. In an interview on September 9, 2026, he cast himself as a reformed hacker trying to contribute to society, and said he was settling civil suits and making restitution to earlier victims. Soon afterward he went silent. Sources say he was detained on or around September 16; a witness saw authorities carting items from his home.

A voice from the Odido breach

Police had earlier sought help identifying a voice on a February 2026 call in which a native Dutch-speaking ShinyHunters member social-engineered their way into Odido, the country's largest mobile operator, stealing data on more than 6.2 million people. The group confirmed the caller was one of theirs, promised him full support and a lawyer, and derided the Dutch police as "incompetent" and "useless" while threatening more thefts.

The FBI and Cl0p hacks

Days after the arrest, ShinyHunters claimed the breach of the FBI's job-application site, apply.fbijobs.gov. Per 404 Media, the haul included Social Security numbers and data on more than 5,000 officials — job titles and, as Reuters found, sensitive psychiatric and medical files. The group exploited a recently patched flaw (CVE-2026-35273) in Oracle PeopleSoft, sidestepping Mandiant's recommended firewall rules with a URL-encoding trick.

The Umbreon alias was hidden in plain sight: the defacement left on the FBI site featured an ASCII rendition of the Pokémon Umbreon. Sources believe the group's abrupt turn toward reckless attacks came after a takeover by a teenager from Amman known as Rey, of ScatteredLapsussHunters, who had a feud with the Dutchman over the brand — and the oversized Umbreon image may have been an attempt to pin the hack on him.

Mandiant's Austin Larsen estimates ShinyHunters could pull in nearly $100 million in extortion payments in 2026. Van der Stap insisted money never drove him; his real "habit," he said, was collecting data.

Source: Krebs on Security