Pevita Pearce
Introduction: A Cybercriminal’s Double Life
In the high-stakes arena of global cyber-espionage, the line between security researcher and digital extortionist has often blurred, but few cases illustrate this duality as starkly as that of 24-year-old Dutch national Pepijn van der Stap. Authorities in the Netherlands recently apprehended van der Stap, a convicted cybercriminal whose journey from a software engineer at an Amsterdam-based security startup to a prime suspect in a massive international data-theft spree has sent shockwaves through the cybersecurity community.
Van der Stap, previously known in the underground hacking scene by the handle "Umbreon," stands accused of aiding the notorious hacker collective ShinyHunters. His arrest has not only destabilized a prolific group of cyber-predators but has also triggered a dangerous, retaliatory escalation in their operations, resulting in audacious breaches of the FBI’s job application portal and the targeting of the Russian ransomware syndicate Cl0p.
The Jekyll and Hyde of Almere
To those who knew him professionally, van der Stap was a diligent, if perhaps eccentric, software engineer. By day, he contributed his technical expertise to the cybersecurity firm Hadrian and volunteered for the Dutch Institute for Vulnerability Disclosure (DIVD). Yet, in the shadows, he was "Umbreon," a prolific data trafficker who populated forums like RaidForums and Breached with stolen databases.
Van der Stap’s criminal career was not a secret to Dutch authorities. In 2023, he was convicted for his role in a series of thefts that generated between €1.5 million and €2.7 million. During his trial, he painted a portrait of a man struggling with psychological burdens, including PTSD linked to childhood trauma. He famously admitted to a "Dr. Jekyll and Mr. Hyde" existence, opting for incarceration over house arrest because he believed the prison system offered better stability for his mental health needs. Released in December 2025, he claimed to be a reformed individual, even securing a position as an offensive security lead at Neo Security.
However, the facade crumbled when intelligence linked him to the February 2026 compromise of Odido, the Netherlands’ largest mobile telecommunications provider. That breach, which exposed the personal data of 6.2 million Dutch citizens, was executed through sophisticated social engineering—a voice recorded in a malicious phone call matched the profile of the ShinyHunters operation, leading police directly to van der Stap.
Chronology of an Escalation
The arrest of van der Stap on September 16, 2026, served as a catalyst for a series of unprecedented attacks by the remaining members of ShinyHunters.
- February 2026: ShinyHunters compromises Odido, leveraging social engineering to steal data on 6.2 million people.
- September 2026: Dutch authorities arrest van der Stap. Police are observed seizing hardware and digital assets from his residence.
- Late September 2026: Following the arrest, ShinyHunters launches a brazen assault on
apply.fbijobs.gov. They exfiltrate sensitive data on over 5,000 FBI officials, including personnel investigating foreign state-sponsored cyber threats. - Late September 2026: ShinyHunters shifts focus to the Russian ransomware gang Cl0p, escalating their extortion tactics and publicly taunting both the FBI and their criminal rivals.
- September 29, 2026: Reports emerge from Dutch news outlet RTL suggesting that investigators are probing allegations that van der Stap may have attempted to orchestrate murders abroad.
The "Rey" Factor: A New Era of Volatility
Intelligence sources indicate that the recent shift in ShinyHunters’ behavior—moving from opportunistic data theft to high-stakes political and criminal provocation—is linked to a change in leadership. The group has increasingly come under the influence of a teenage hacker from Amman, Jordan, known as "Rey."
Rey is a key operative within the "ScatteredLapsussHunters" (SLSH) coalition, an entity born from the merger of Scattered Spider, LAPSUS$, and ShinyHunters. According to cybersecurity experts, Rey maintains an intense rivalry with van der Stap over the control of the ShinyHunters brand. The inclusion of "Umbreon" ASCII art in the FBI job portal defacement was likely a tactical move by Rey to frame the incarcerated Dutchman for the FBI breach, effectively burning his bridges while asserting dominance over the collective.
The rivalry is rooted in a failed partnership with "TeamPCP," a group that specialized in supply-chain compromises. When TeamPCP’s stolen credentials were rendered useless by proactive interventions from Mandiant and major cloud providers, the groups turned on each other. ShinyHunters, under Rey’s direction, went rogue, monetizing the stolen data while cutting out their former partners, leading to a breakdown in communication and a subsequent explosion of inter-gang hostility.
Supporting Data: Exploiting the PeopleSoft Vulnerability
The technical prowess of this modern iteration of ShinyHunters cannot be understated. The group exploited a zero-day vulnerability in Oracle’s PeopleSoft (CVE-2026-35273) to gain unauthorized access to government and corporate systems. Despite patches being issued and Mandiant providing mitigation rules, ShinyHunters demonstrated high-level agility, utilizing a URL-encoding trick to bypass security firewalls.
Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that this exploitation campaign was mass-conducted, affecting industries ranging from healthcare and agriculture to transportation and higher education. Experts at Mandiant estimate that ShinyHunters is on track to net nearly $100 million in extortion payments in 2026 alone—a staggering figure that highlights the lucrative nature of modern, large-scale data extortion.
Official Responses and the FBI’s Warning
The FBI’s response to the breach of their own portal was both defensive and stern. Brett Leatherman, assistant director of the FBI’s cyber division, released a video message thanking Dutch law enforcement for their cooperation. His message to the remaining ShinyHunters members was clear: "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left."
Leatherman’s rhetoric emphasizes the FBI’s ability to track the group’s digital footprint. While ShinyHunters continues to publicly mock the Dutch police—calling them "incompetent" and "irrelevant"—the reality is that the net is tightening. The involvement of the FBI in a cross-border investigation suggests that the consequences for those remaining in the group will be severe.
Implications: The Future of Cybercrime
The transition of ShinyHunters from a group focused on "collecting data" to a militant, extortion-driven organization represents a broader, disturbing trend in the cybercrime ecosystem. The involvement of younger, more volatile actors like Rey, who operate with a mix of political bravado and criminal nihilism, marks a departure from the traditional "profit-first" model.
Furthermore, the allegations that van der Stap may have moved beyond digital theft into the realm of ordering physical violence (as reported by RTL) signify a terrifying maturation of these criminal enterprises. If the line between hacking and organized violent crime is officially erased, the response from international law enforcement will likely shift from traditional investigative techniques to paramilitary-style interventions.
As the Dutch District Court in Rotterdam prepares for the upcoming hearings, the case of Pepijn van der Stap serves as a grim case study. It exposes the fragility of corporate security, the dangerous influence of radicalized youth in cyber-undergrounds, and the reality that no institution—not even the FBI—is immune to the reach of those who treat global security as a playground for their personal agendas.
The battle for the "ShinyHunters" brand is far from over, but as Leatherman noted, the choice for its remaining members is rapidly narrowing: surrender to the authorities or face the inevitable exposure that comes with the FBI’s relentless pursuit of those who threaten the digital foundations of the modern world.
Ali Ikhwan
Basiran
