Dutch Police Arrest Former Hacker Pepijn van der Stap in ShinyHunters Probe
Dutch authorities have arrested 24-year-old Pepijn van der Stap, a previously convicted cybercriminal and offensive security lead at Amsterdam-based startup Neo Security, on suspicion of aiding data thefts and extortions orchestrated by the prolific hacker group ShinyHunters, independent journalist Brian Krebs reported. The arrest on or around September 16 triggered an immediate, aggressive escalation from remaining members of the hacking collective, who launched widespread data exfiltration attacks against high-profile targets including the Federal Bureau of Investigation and the Russian ransomware syndicate Cl0p.
ShinyHunters Breaches FBI Portal After Dutch Arrest
- What Happened: Dutch police arrested 24-year-old Pepijn van der Stap in mid-September for alleged ties to the ShinyHunters collective.
- The Blast Radius: Following the detention, ShinyHunters launched mass retaliatory attacks, exploiting a recently patched vulnerability (CVE-2026-35273) in PeopleSoft to breach the FBI job application portal.
- The Technical Reality: Mandiant researcher Austin Larsen stated the group is on track to pull in nearly $100 million in extortion payments from cybercrime victims in 2026.
Pepijn van der Stap Arrested by Dutch Authorities in Cybercrime Probe
According to three sources familiar with the matter cited by KrebsOnSecurity, Dutch police detained van der Stap in a raid on or around September 16. Benjamin Korper, of Amsterdam-based cybersecurity firm Neo Security, confirmed to Reuters that Dutch forensic investigators visited his offices on September 15, identifying the detained individual as van der Stap, the company’s offensive security lead. The Canadian Broadcasting Corporation (cbc.ca) also reported the arrest, noting that Dutch police announced a 24-year-old man would appear before the Rotterdam District Court on Tuesday, September 29.
The arrest marks a dramatic twist in van der Stap’s public trajectory. Convicted in late 2023 for operating under the hacker handle “Umbreon” on defunct underground forums like RaidForums and Breached—where prosecutors stated his data thefts earned between €1.5 million and €2.7 million—van der Stap was sentenced to four years in prison (one of which was suspended). During his 2023 trial, court records showed he had maintained a dual existence as an extortionist while concurrently working as a software engineer for the cybersecurity startup Hadrian and volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD). Shortly after an interview, he ceased communication, preceding the September police raid.
ShinyHunters Escalates Attacks and Targets the FBI Following Detention
In the days immediately following the detention of van der Stap, remaining ShinyHunters members dramatically escalated their operations, claiming responsibility for a major breach at the FBI jobs site. The group also directed extortion threats against the Russian ransomware operation Cl0p.
Security analysts linked the breach directly to the mass exploitation of a recently patched vulnerability, CVE-2026-35273, residing within Oracle’s PeopleSoft enterprise human resources platform. ShinyHunters said it gained access to the FBI site and other victims by exploiting this vulnerability.
Throughout the campaign, the hackers embedded visual signatures referencing van der Stap’s former alias. The defacement message left on the FBI jobs portal featured an ASCII art rendition of the Pokémon character Umbreon alongside the text: “This site has been seized by ShinyHunters. rooting your systems since ’19 ;).”
Rey Attempts to Frame Suspect for FBI Hack
Sources close to the investigation indicated that the prominent display of the Umbreon artwork on the FBI portal was likely an attempt by Rey to pin the hack on the Dutchman. Rey, first publicly identified by the cybersecurity firm KELA in March 2025, has been described as the head of ShinyHunters.
Adding to the threats, a Wired investigation detailed how ShinyHunters had previously partnered with TeamPCP, but later "went rogue, carrying out its own extortions with TeamPCP’s credentials but without giving the supply-chain hackers their cut."
Despite the infrastructure disruption, Mandiant researcher Austin Larsen stated that ShinyHunters remains on track to extract nearly $100 million in illicit extortion payments across 2026. Meanwhile, ShinyHunters representatives issued statements dismissing the Dutch police as “unskilled and incompetent” and asserting that their team member maintains the group’s full emotional, mental, and financial support.
NGINX Configuration Prevents URL Encoding Attacks
# Example NGINX / ModSecurity configuration snippet for rigorous URL normalization
SecRuleEngine On
SecRule REQUEST_URI "@rx %u[0-9a-fA-F]{2}"
"id:1001,
phase:1,
deny,
status:403,
log,
msg:'Potential URL-Encoding Attack Detected - Normalization Failure'"
Suspect Faces Court for Cybercrime and Murder
The detained 24-year-old suspect is scheduled to appear before the chambers of the Rotterdam District Court on Tuesday, September 29, according to official statements released by Dutch police on X. Concurrently, Dutch broadcaster RTL reported that investigators suspect van der Stap tried to orchestrate at least two murders abroad, and that there are indications the suspect gave the order for this.
In an official video briefing regarding the ongoing international sweep, Brett Leatherman, assistant director of the FBI’s cyber division, acknowledged the cooperation of Dutch law enforcement and urged remaining members of the collective to surrender. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” Leatherman stated.
Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.