24-Year-Old Arrested in Dutch Investigation Into ShinyHunters
Dutch police arrested 24-year-old Pepijn van der Stap, alias Umbreon, in the ShinyHunters investigation; he appeared before Rotterdam District Court.
Dutch police arrested a 24-year-old Amsterdam man earlier in September 2026 as part of the ShinyHunters investigation; KrebsOnSecurity identified him as Pepijn van der Stap, alias 'Umbreon,' previously convicted in 2023 for data thefts and extortions earning €1.5-2.7 million. ShinyHunters is reportedly now led by a Jordanian teenager known as 'Rey' operating via ScatteredLapsussHunters, an amalgamation of Scattered Spider, LAPSUS$ and ShinyHunters, and Mandiant estimates the group is on track for nearly $100 million in extortion payments in 2026. The group's recent activity includes the FBI jobs site breach and an extortion attempt against Cl0p. The related Odido breach exposed data of over 6.2 million Dutch people via a vishing credential-theft call.