Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Dutch police arrested a 24-year-old Amsterdam suspect, identified as Pepijn van der Stap, in the ShinyHunters investigation.
Dutch police confirmed that a 24-year-old Amsterdam man was arrested on September 16 in an investigation into the ShinyHunters extortion group and was due in court on Monday. The suspect is believed to be Pepijn van der Stap, convicted in 2023, previously known as Umbreon, and employed as offensive security lead at Neo Security while on supervised release. Brian Krebs reports the group's leader, a teenager nicknamed Ray in Amman and linked to Scattered Lapsus$ Hunters, blamed him for an FBI jobs-site hack that used a modified exploit for Oracle PeopleSoft CVE-2026-35273, which the group exploited as a zero-day in June. Police are also probing a social-engineering call against telecom Odido that exposed 6.2 million people's data; DataBreaches says the recorded voice is not van der Stap's.
- Dutch police arrested a 24-year-old Amsterdam man on September 16 in a ShinyHunters investigation.
- The suspect is believed to be Pepijn van der Stap, convicted in 2023 as Umbreon.
- Krebs says the group blamed him for an FBI jobs-site hack exploiting CVE-2026-35273.
- Odido lost data on 6.2 million people; the recorded voice reportedly is not his.
Vulnerabilities mentionedAll →
- CVE-2026-352739.89%Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleToolspublished · Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component) KEV ransomware
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article362 words · extracted from securityweek.com · click to collapse
The Dutch police have confirmed the arrest of an individual suspected of being associated with the ShinyHunters extortion group.
“This month a 24-year-old man from Amsterdam was indeed arrested in an investigation into the hacker group ShinyHunters,” the Dutch police said on Monday.
The suspect is believed to be Pepijn van der Stap, a hacker convicted in 2023 for multiple intrusions followed by data theft and extortion.
Investigative journalist Brian Krebs reports that prior to his conviction, van der Stap used the online hacker handle Umbreon in his extortion activities while working as a software engineer at cybersecurity startup Hadrian.
When arrested on September 16, the 24-year-old was on supervised release after serving three years of his four-year prison sentence. He is now employed as offensive security lead at Neo Security.
According to Krebs, ShinyHunters’ recent FBI hack appears to have been pinned on van der Stap by the group’s current leader, a teenage cybercriminal from Amman, Jordan, nicknamed Ray, who is also a part of the ScatteredLapsussHunters hacking group.
Advertisement. Scroll to continue reading.
ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273, the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement.
In early September, Dutch police asked for the public’s help in identifying the voice in the audio recording of a social engineering attack targeting the telecommunications provider Odido, which resulted in the theft of 6.2 million people’s data.
ShinyHunters reportedly confirmed that one of its members made the call, but said the police would not be able to link it to a real person. According to DataBreaches, the voice in the audio clip is not van der Stap’s.
On Monday, the Dutch police said the suspect arrested earlier this month is scheduled to appear in court today and promised additional information after the hearing.
Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon
Related: Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court
Related: US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks
Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft