The world of international cybercrime was thrown into a state of high-stakes volatility this September, following the arrest of 24-year-old Dutch national Pepijn van der Stap. Long suspected of operating under the hacker handle "Umbreon," van der Stap’s apprehension by Dutch authorities has acted as a catalyst for a series of increasingly desperate and brazen cyberattacks carried out by his former associates in the notorious hacking collective, ShinyHunters.
The arrest has exposed a dark underbelly of the modern digital underground, revealing a landscape where reformed white-hat professionals and ruthless extortionists operate in the same circles. As authorities tighten the net around the group, the internal dynamics of ShinyHunters have devolved into a "scorched earth" campaign, leaving behind a trail of compromised federal data and chilling allegations of violence.
The Arrest and the "Dr. Jekyll" Duality
On or around September 16, Dutch police detained van der Stap in a raid that reportedly involved the seizure of extensive hardware from his residence. For many in the cybersecurity industry, the arrest was a jarring conclusion to what appeared to be a successful rehabilitation story.
Van der Stap, previously convicted in 2023 for a series of data thefts that generated between €1.5 million and €2.7 million, had spent his post-prison life positioning himself as a reformed expert. By day, he served as an offensive security lead for the Dutch firm Neo Security; by night, he had once volunteered for the Dutch Institute for Vulnerability Disclosure (DIVD).
During his 2023 trial, van der Stap famously described his life as a "Dr. Jekyll and Mr. Hyde" existence. He admitted that his compulsion was not necessarily money, but the obsessive collection and categorization of stolen databases. Despite his public claims of redemption in a September 9 interview with KrebsOnSecurity, his sudden silence—followed by his arrest—suggests that his ties to the criminal underworld were never fully severed.
Chronology of a Digital Meltdown
The timeline of the current escalation reveals a group under extreme pressure, lashing out at both law enforcement and rival criminal organizations:
- February 2026: A native Dutch-speaking member of ShinyHunters social-engineers a breach of Odido, the Netherlands’ largest mobile telecommunications provider, stealing data on 6.2 million citizens.
- September 9, 2026: Pepijn van der Stap publicly maintains his stance as a reformed hacker, claiming he is working to make amends for his past.
- September 16, 2026: Dutch authorities arrest van der Stap.
- Late September 2026: ShinyHunters engages in a dramatic escalation, breaching the FBI’s job application portal (apply.fbijobs.gov) and stealing sensitive personal information on over 5,000 officials.
- September 25, 2026: Mandiant and Google Threat Intelligence report that ShinyHunters has mass-exploited a vulnerability in Oracle’s PeopleSoft software, affecting diverse industries worldwide.
- September 29, 2026: Reports emerge from the Dutch outlet RTL that van der Stap is suspected of orchestrating at least two murders, marking a terrifying evolution from digital theft to physical violence.
The Rise of "Rey" and the Internal Power Struggle
Security researchers have identified a major shift in the leadership of ShinyHunters. Sources indicate the group is now effectively controlled by a teenage cybercriminal based in Amman, Jordan, known as "Rey." Rey is a prominent figure within "ScatteredLapsussHunters" (SLSH), a hybrid organization born from the remnants of Scattered Spider, LAPSUS$, and ShinyHunters.
The relationship between van der Stap and Rey was defined by deep-seated hostility. According to multiple sources, Rey likely used the "Umbreon" imagery—a Pokémon character associated with van der Stap—in the FBI portal defacement specifically to frame the arrested Dutchman and draw heat away from his own operations.
This power struggle was exacerbated by the failure of a partnership with "TeamPCP," a group that specialized in supply-chain compromises. When credentials stolen by TeamPCP were invalidated by major cloud providers—thanks in part to covert intervention by Mandiant—the groups began blaming each other. ShinyHunters, acting on its own initiative, allegedly began monetizing TeamPCP’s stolen data without sharing the proceeds, further alienating their criminal peers.
The FBI Breach: A Brazen Provocation
The attack on the FBI’s job application site represents a departure from the group’s typical focus on commercial enterprise. By stealing Social Security numbers, psychiatric records, and professional details of special agents and cybercrime investigators, ShinyHunters sought to demonstrate their reach.
The group successfully exploited CVE-2026-35273, a PeopleSoft vulnerability. Even after Oracle issued a patch and security researchers provided mitigation rules, ShinyHunters deployed a URL-encoding trick to bypass web application firewalls. This level of technical sophistication suggests that despite the loss of van der Stap, the collective remains a significant threat to global digital infrastructure.
Official Responses and the Global Manhunt
The Dutch authorities have been uncharacteristically vocal regarding the investigation. In a public plea, police requested help identifying the voice from the Odido hack recording. The group’s response was one of pure defiance, issuing statements calling the Dutch police "incompetent" and "useless," while vowing further large-scale attacks.
The FBI has since responded with a calculated message. Brett Leatherman, assistant director of the FBI’s cyber division, released a video statement thanking the Dutch National Police for their cooperation. His words served as a warning to the remaining members of the collective: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left."
Implications: A New Era of Cyber-Violence
The transition from simple data exfiltration to the alleged orchestration of physical violence marks a harrowing turning point in the history of cybercrime. If the allegations regarding van der Stap’s involvement in murder-for-hire plots are proven, it indicates that the "digital" and "physical" threats are no longer separate.
Furthermore, the rise of teenage "admin" figures like Rey highlights a demographic shift in cybercrime. These young, globally distributed hackers often view themselves as part of a larger, borderless movement, unburdened by traditional morality and motivated by a blend of financial gain, "clout," and ideological conflict.
For organizations, the implications are clear: the threat landscape is no longer just about protecting data from theft; it is about protecting employees from the risks inherent in working for high-profile institutions. As ShinyHunters continues its erratic campaign of destruction, the international intelligence community must grapple with a group that has moved beyond the logic of extortion and into the realm of nihilistic aggression.
The arrest of Pepijn van der Stap is a significant blow to the group, but as the FBI’s statement suggests, the investigation is far from over. The coming months will likely see a continued game of cat-and-mouse, as the authorities seek to dismantle the remaining infrastructure of the SLSH collective and bring those responsible for these unprecedented breaches to justice.
