The Fall of ‘Umbreon’: How the Arrest of a Reformed Dutch Cybercriminal Ignited Global Chaos, an FBI Breach, and a Turf War
AMSTERDAM/WASHINGTON — In the murky underworld of international cybercrime, few alliances are as volatile, fast-moving, or destructive as the hacking collective known as ShinyHunters. Long recognized for high-profile data thefts, mass extortion schemes, and an uncanny ability to evade law enforcement, the group has recently been thrust into an unprecedented spiral of chaos.
The catalyst? The mid-September arrest of a 24-year-old Dutch national in the Netherlands—a convicted cybercriminal who attempted to live a dual life as a legitimate corporate security professional while allegedly maintaining ties to the group’s infrastructure.
The detention of Pepijn van der Stap—better known by his hacker handle “Umbreon”—unleashed a seismic reaction across the global cyber landscape. In the immediate aftermath, remaining members of ShinyHunters escalated their operations with reckless velocity. The syndicate launched a high-profile attack on the FBI, brazenly extorted the Russian ransomware operation Cl0p, and became embroiled in an internal leadership civil war spearheaded by a teenage cybercriminal from Jordan.
As law enforcement agencies on both sides of the Atlantic close in, the saga has evolved from a standard transnational cyber-investigation into a sprawling thriller involving corporate espionage, malicious artificial intelligence, bitter turf wars, and astonishing allegations of contracted violence.
Main Facts: The Arrest of Pepijn van der Stap
According to multiple sources familiar with the ongoing international investigation, Dutch authorities apprehended Pepijn van der Stap in or around September 16. Witnesses reported seeing law enforcement officers carrying hardware and personal items out of the suspect’s residence in the Netherlands.
Van der Stap is no stranger to law enforcement. In late 2023, he was convicted for a massive string of data thefts and extortions that prosecutors estimated netted between €1.5 million and €2.7 million. During his trial, van der Stap openly admitted to maintaining a Dr. Jekyll and Mr. Hyde existence. Under the moniker “Umbreon”—inspired by the Pokémon character—he extorted victims and traded stolen databases on English-language underground forums like RaidForums and Breached.
Simultaneously, however, van der Stap maintained a day job as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup, and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research collective.
Following his 2023 conviction, van der Stap was sentenced to four years in prison, with one year suspended. Choosing to remain in custody initially due to ongoing struggles with psychological issues and childhood trauma-related PTSD, he was eventually released in December 2025.
In a September 9, 2026, interview with KrebsOnSecurity, van der Stap portrayed himself as a completely reformed individual attempting to make amends. At the time of his arrest, he was employed as an offensive security lead at the Dutch firm Neo Security and was actively dealing with civil lawsuits and financial restitution stemming from his past offenses.
However, Dutch police confirmed the arrest of a 24-year-old man in connection with the ShinyHunters probe, scheduling his appearance before the Rotterdam District Court. In a shocking late development, Dutch outlet RTL reported that investigators now suspect van der Stap of attempting to orchestrate at least two contract murders abroad, adding an extraordinary criminal dimension to what began as a data-theft investigation.
Chronology of Escalation: From Odido to the FBI
The timing of van der Stap’s apprehension directly correlates with a drastic escalation in aggressive cyberattacks attributed to ShinyHunters and its associated factions.
The Odido Intrusion
Earlier this year, Dutch police launched a public appeal to identify a native Dutch-speaking member of ShinyHunters who social-engineered their way into Odido, the Netherlands’ largest mobile telecommunications provider. Using a spoofed website, the attacker tricked an Odido employee into logging in, harvesting data belonging to more than 6.2 million Dutch citizens.
When local media spotlighted the audio recording of the social engineering call, ShinyHunters defiantly confirmed the suspect was in their ranks. In a public statement, the group promised full emotional and financial support for their detained comrade while hurling insults at local authorities: "The Dutch police will need all the luck in the world… Frankly, the Dutch police are a big joke; they are incapable of doing anything."
The Breach of apply.fbijobs.gov
Days after van der Stap’s mid-September detention, ShinyHunters claimed responsibility for an astonishingly brazen intrusion: the compromise of the FBI’s job application portal, apply.fbijobs.gov.
Working in tandem with reports from 404 Media and Reuters, security analysts revealed that the breach exposed Social Security numbers and personal details of over 5,000 personnel. The compromised data included specific job classifications, such as special agents, threat intake examiners, and members of major cybercrime and foreign state-backed threat units. Furthermore, hackers accessed sensitive medical and psychiatric files belonging to bureau employees.
Prominently displayed within the defacement message left on the FBI portal was an ASCII art rendition of the Pokémon character Umbreon—a direct nod to van der Stap’s historic alias. Security experts believe the inclusion of the character was a calculated move by rival faction leaders aiming to frame or implicate the detained Dutchman.
Supporting Data: Exploiting Oracle PeopleSoft and Web Application Firewall Bypasses
The technical mechanics behind ShinyHunters’ 2026 campaign reveal a high degree of operational sophistication. The group gained unauthorized entry into systems—including the FBI portal—by exploiting a recently patched zero-day vulnerability (CVE-2026-35273) in PeopleSoft, a widely utilized human resources, payroll, and recruitment platform owned by enterprise software giant Oracle.
Although Oracle swiftly issued security patches and security firms like Mandiant released mitigation web application firewall (WAF) rules, threat actors quickly evolved. According to reports from BleepingComputer and the Google Threat Intelligence Group (GTIG), ShinyHunters bypassed Mandiant’s defensive rules by employing sophisticated URL-encoding tricks.
Mandiant and GTIG confirmed that ShinyHunters leveraged this PeopleSoft exploit in a mass-exploitation campaign, siphoning proprietary data from dozens of organizations across critical industries:
- Higher education
- Technology and software development
- Healthcare institutions
- Agriculture and logistics
- Transportation networks
- Government agencies
According to Mandiant researcher Austin Larsen, ShinyHunters’ aggressive extortion operations are on track to rake in nearly $100 million in illicit payouts throughout 2026, marking a significant financial departure from their earlier, smaller-scale database hoarding days.
Internal Chaos: The Rise of ‘Rey’ and the SLSH Alliance
The pivot from calculated, quiet data exfiltration to high-stakes, risky attacks against the FBI and Russian ransomware syndicates like Cl0p stems from a fundamental internal power struggle.
Sources close to the ongoing investigations indicate that control of the ShinyHunters brand was violently usurped by a teenage cybercriminal from Amman, Jordan, known online as Rey. Rey operates as a core administrator within ScatteredLapsussHunters (SLSH)—an aggressive syndicate formed by the merger of three infamous hacking groups: Scattered Spider, LAPSUS$, and ShinyHunters.
Rey was initially unmasked by cybersecurity firm KELA in early 2025. Following news of the FBI portal breach, Rey’s primary social media account on X (formerly Twitter) engaged in relentless taunting, posting crude memes mocking both the FBI and the Cl0p ransomware syndicate. Shortly after inquiries were made to Rey’s father—an employee of Royal Jordanian Airlines—the teenager’s long-standing social media accounts were abruptly deleted.
The TeamPCP Fallout
The hostility between SLSH and traditional ShinyHunters factions traces back to an ill-fated partnership earlier in the year. The groups briefly collaborated with TeamPCP, an upstart collective specializing in compromising software supply chains.
However, undercover investigations by Mandiant revealed that security analysts were secretly burning TeamPCP’s stolen credentials by feeding them directly to major cloud providers like Microsoft and Amazon, rendering them instantly invalid. When the stolen keys stopped working, the allied hacker factions turned on each other. According to reporting by Andy Greenberg in Wired, ShinyHunters went rogue, using TeamPCP’s credentials to execute independent extortions while cutting out their partners. This backstabbing cemented a bitter internal war for supremacy and brand control.
Official Responses and Broader Implications
International law enforcement agencies have signaled a unified, aggressive stance against the fractured syndicate.
In a recorded video statement released via social media, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, formally thanked Dutch law enforcement partners for their indispensable collaboration. Leatherman issued a direct warning to the remaining members of ShinyHunters:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Meanwhile, the ripples of the investigation are touching peripheral organizations. The DIVD, where van der Stap formerly volunteered, recently disclosed that it suffered an internal cybersecurity incident involving the suspected malicious use of artificial intelligence. While DIVD representatives clarified that the incident bears no connection to ShinyHunters or their former volunteer, it highlights the constant threat landscape facing independent research groups.
Implications for Global Cybersecurity
The unfolding saga surrounding Pepijn van der Stap, the shadowy rise of Rey, and the audacious targeting of federal law enforcement mark a critical turning point in modern cyber-policing.
- Erosion of Safe Harbors: The willingness of international syndicates to target high-value government targets like the FBI demonstrates a desperate, high-risk operational posture driven by internal infighting and heavy law enforcement pressure.
- The Insider Threat Matrix: Van der Stap’s case reinforces the terrifying reality of the "dual life" cybercriminal—individuals capable of working legitimately for cutting-edge defensive cybersecurity firms by day while orchestrating multinational extortion rings by night.
- The Power of Seized Infrastructure: As Leatherman noted, the compromise and dismantling of cybercriminal command-and-control infrastructure invariably leads to a domino effect of internal betrayals, arrests, and the unravelling of even the most resilient threat groups.
As Pepijn van der Stap faces Rotterdam’s district judges to answer for his past digital crimes—and now, astonishing allegations of conspiracy to commit murder—the remnants of ShinyHunters find themselves increasingly cornered, hunted, and fighting a war on multiple fronts against global law enforcement.
