Dutch Authorities Arrest Alleged ShinyHunters Member in Cybersecurity Case
Amsterdam man linked to high-profile hacker group faces legal proceedings
1Suspect's background
Dutch authorities arrested 24-year-old Pepijn van der Stap (aka Umbreon) from Amsterdam on September 15, 2026, in connection with ShinyHunters. The suspect previously worked at cybersecurity firm Hadrian and volunteered at Dutch Institute for Vulnerability Disclosure. His current LinkedIn profile lists him as offensive security lead at Neo Security, while acknowledging his unconventional career path in cybersecurity.
2Previous criminal activity
Van der Stap was previously apprehended in 2023 for involvement in data thefts and extortions. In June 2023, he admitted to DataBreaches.Net that working legitimate cybersecurity jobs actually increased his paranoia about being caught. Despite claiming to do 'more lawful work,' he described extreme anxiety about impending arrest while continuing illegal activities.
3ShinyHunters' recent claim
The arrest follows ShinyHunters' claim of hacking the FBI's job application site, stealing terabytes of sensitive data. The group framed this as a 'marketing campaign' to combat disinformation, stating normal statements wouldn't have gained such attention. They maintain the attack wasn't financially motivated extortion, despite their history of such operations.
4Technical attack details
ShinyHunters initially claimed to exploit a zero-day in Oracle PeopleSoft for the FBI breach, but investigators now believe they bypassed web application firewall rules using URL-encoding tricks targeting CVE-2026-35273. This demonstrates their evolving technical sophistication in circumventing security measures designed to protect sensitive government systems.
5Legal proceedings
Van der Stap is scheduled to appear before Rotterdam District Court on September 29, 2026. Dutch police haven't disclosed specific charges, but his arrest connects to ongoing investigations into ShinyHunters' activities. The timing coincides with increased scrutiny following the group's high-profile FBI breach claims.
6Security industry implications
The case highlights the blurred lines between white-hat and black-hat activities in cybersecurity. Van der Stap's simultaneous employment in legitimate security roles while allegedly participating in criminal operations raises questions about vetting processes in the industry, particularly for offensive security positions with access to sensitive systems.
7Psychological profile
Van der Stap's statements reveal a complex psychology - claiming his legitimate cybersecurity work increased paranoia while continuing illegal activities. His LinkedIn profile acknowledges learning 'hard lessons' from seeing security 'from both sides of the terminal,' suggesting awareness of his actions' implications without clear remorse.
8Broader security landscape
This arrest occurs as AI agents gain increasing access to sensitive enterprise systems while security teams struggle with visibility and controls. Attackers are leveraging AI for reconnaissance and access escalation, creating new challenges for cybersecurity professionals combating sophisticated threats like those allegedly posed by ShinyHunters.