Dutch 'Reformed' Hacker Arrested in ShinyHunters Cybercrime Probe
Pepijn van der Stap's arrest triggers retaliatory attacks on FBI and Russian hackers.
1Dual identity revealed
Pepijn van der Stap, a 24-year-old Dutch national, maintained parallel careers as a cybersecurity professional at startup Hadrian and volunteer at DIVD while secretly operating as hacker 'Umbreon'. His 2023 conviction exposed €1.5-2.7 million in data theft profits. The cybersecurity community was shocked when his alter ego was linked to selling databases containing 2.3 million Dutch citizens' data on RaidForums in 2021.
2Psychological complexities
During his 2023 trial, van der Stap requested continued detention citing untreated PTSD from childhood trauma. Despite a 4-year sentence (1 suspended), he portrayed himself as reformed in a 2026 interview while working at Neo Security. His abrupt communication cutoff weeks before arrest suggests possible relapse or coercion by ShinyHunters members contesting control of stolen data assets.
3ShinyHunters' retaliation
Within days of van der Stap's detention, ShinyHunters breached the FBI's job portal, stealing 5,000 officials' SSNs and psychiatric records. They exploited CVE-2026-35273 in Oracle's PeopleSoft before patches could be widely implemented. The group taunted Dutch authorities, threatening 'large-scale data theft' while mocking their capabilities. Security analysts noted this marked escalation from their typical operations.
4Power struggle evidence
The FBI breach contained ASCII art of Pokémon's Umbreon—van der Stap's former alias. Investigators believe this was planted by Jordanian teen 'Rey', who recently assumed ShinyHunters leadership through merger with ScatteredLapsussHunters. Rey's Twitter taunts included 9/11 imagery targeting Cl0p ransomware group with Umbreon prominently featured, suggesting framing attempts amid internal conflicts over data control.
5Monetization disputes
Mandiant researchers revealed ShinyHunters diverted from partner TeamPCP's supply-chain attacks to independently extort victims, potentially earning $100 million in 2026. Earlier collaborations failed when credentials were invalidated after Mandiant secretly fed them to cloud providers. These financial tensions may have precipitated van der Stap's arrest, as competing factions sought control over lucrative data troves.
6Technical sophistication
ShinyHunters bypassed Mandiant's recommended WAF rules for the PeopleSoft flaw using URL-encoding tricks. Google's GTIG confirmed mass exploitation across education, healthcare and government sectors. The group's operational security includes using legitimate platforms like LinkedIn for communications while maintaining plausible deniability through intermediary accounts and encrypted channels.
7Law enforcement coordination
Dutch authorities collaborated with FBI's Cyber Division, leveraging seized infrastructure to identify remaining members. The arrest coincided with DIVD (where van der Stap volunteered) investigating an AI-related security incident, though no connection was confirmed. Rotterdam District Court will hear charges including potential murder-for-hire plots abroad, indicating expanding investigation scope.
8Industry-wide implications
Oracle's delayed patch rollout for PeopleSoft left organizations vulnerable for months. Mandiant's report highlights how SaaS platforms become single points of failure—when compromised, they expose HR, payroll and benefits data across all clients. This incident may accelerate adoption of zero-trust architectures and stricter vendor security requirements in enterprise software procurement processes.
9Psychological warfare tactics
ShinyHunters' public statements demonstrate sophisticated media manipulation, offering 'emotional/financial support' to arrested members while taunting authorities. Their NL Times interview and FBI defacement messages create narrative control, framing themselves as unstoppable. Security analysts note this erodes public trust in law enforcement's cyber capabilities while recruiting disillusioned hackers.
10Career paradox
Van der Stap's case exposes vulnerabilities in cybersecurity hiring practices. His volunteer work at DIVD provided insider knowledge while his startup role offered technical access. The industry lacks standardized background checks for rehabilitated hackers, especially those with non-financial motives like van der Stap's confessed 'data collecting obsession' rather than monetary gain.
11New era of cyber conflicts
This case exemplifies modern cybercrime's blurred lines—merging ransomware, data theft and corporate espionage with personal vendettas. The ShinyHunters/SLSH merger creates a transnational threat combining technical skills with psychological operations. As law enforcement adapts, the cybersecurity industry must address insider threats and improve information sharing while balancing rehabilitation opportunities.