DUTCH police have confirmed the arrest of a 24-year-old Amsterdam man in connection with the ShinyHunters cybercrime group. The suspect, identified by independent outlets as Pepijn van der Stap (aka Umbreon), was arrested on 15 September 2026 and is slated to appear at Rotterdam District Court on 29 September 2026.
The case was disclosed after law enforcement announced the arrest, with Krebs on Security and DataBreaches[.]Net providing corroboration that van der Stap has a prior 2023 arrest related to data theft and extortion. The reporting also notes that van der Stap has previously been employed at cybersecurity firm Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD); he later described a trajectory that spanned both “white hat” and “black hat” circles in interviews.
The Hacker News report links the arrest to ShinyHunters’ broader activities, including a claim of credit for breaching the FBI’s FBIjobs[.]gov site and for stealing terabytes of data. The article states that ShinyHunters asserted the FBI incident was not extortion or financially motivated, describing the operation as a marketing effort rather than an illicit financial scheme.
It also references evolving technical context around ShinyHunters’ tools and methods, noting that the group exploited a zero-day in Oracle PeopleSoft to gain access and siphon data, while later attributing a URL-encoding bypass to defeat WAF rules designed to mitigate CVE-2026-35273. The report does not specify additional charges or evidence beyond these assertions.