THE Dutch police have confirmed the arrest of a 24-year-old Amsterdam man suspected of links to the ShinyHunters extortion group, with authorities stating he was arrested in September in an investigation into the group. The suspect, believed to be Pepijn van der Stap, was convicted in 2023 for multiple intrusions, data theft and extortion, and he was on supervised release after serving three years of a four-year sentence when taken into custody on 16 September. He is reported to be employed as an offensive security lead at Neo Security.
Security press and journalism corroborate the broader context: ShinyHunters’ recent claim of a hack against the FBI jobs site appears to have hinged on a modified exploit for CVE-2026-35273, the Oracle PeopleSoft vulnerability, used as a zero-day in June, with the defacement featuring an oversized Umbreon image.
Dutch authorities had earlier appealed for public help identifying the voice in an audio clip from a social‑engineering attack on the telecom provider Odido, linked to the 6.2 million people’s data breach, though ongoing reporting suggests the voice clip may not definitively tie to van der Stap. Krebs, citing the investigation, notes the current ShinyHunters leader, a teenage actor from Amman, Jordan, is coordinating claims, while DataBreaches casts doubt on a direct link to the arrested individual.