Back Securityweek

Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

Securityweek •Ionut Arghire • September 29, 2026

The Dutch police have confirmed the arrest of an individual suspected of being associated with the ShinyHunters extortion group.

“This month a 24-year-old man from Amsterdam was indeed arrested in an investigation into the hacker group ShinyHunters,” the Dutch police said on Monday.

The suspect is believed to be Pepijn van der Stap, a hacker convicted in 2023 for multiple intrusions followed by data theft and extortion.

Investigative journalist Brian Krebs reports that prior to his conviction, van der Stap used the online hacker handle Umbreon in his extortion activities while working as a software engineer at cybersecurity startup Hadrian.

When arrested on September 16, the 24-year-old was on supervised release after serving three years of his four-year prison sentence. He is now employed as offensive security lead at Neo Security.

According to Krebs, ShinyHunters’ recent FBI hack appears to have been pinned on van der Stap by the group’s current leader, a teenage cybercriminal from Amman, Jordan, nicknamed Ray, who is also a part of the ScatteredLapsussHunters hacking group.

ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273 , the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement.

In early September, Dutch police asked for the public’s help in identifying the voice in the audio recording of a social engineering attack targeting the telecommunications provider Odido, which resulted in the theft of 6.2 million people’s data .

ShinyHunters reportedly confirmed that one of its members made the call, but said the police would not be able to link it to a real person. According to DataBreaches , the voice in the audio clip is not van der Stap’s.

On Monday, the Dutch police said the suspect arrested earlier this month is scheduled to appear in court today and promised additional information after the hearing.

Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Related: Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court

Related: US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks

Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dutch Hacker Arrested in ShinyHunters Investigation Following FBI Breach Dutch authorities arrested Pepijn van der Stap, a 24-year-old previously convicted hacker, on September 15, 2026, as part of an investigation into the ShinyHunters hacking group. This group claimed responsibility for a significant breach of the FBI's job application site, reportedly stealing sensitive data from over 6,000 FBI personnel. The attack method involved social engineering, where a Dutch-speaking caller impersonated an IT employee to gain access to internal systems. Van der Stap, who had been working as an offensive security lead at Neo Security, was previously convicted in 2023 for data theft and extortion. Following his arrest, ShinyHunters escalated their activities, including further attacks on the FBI and extorting the Cl0p ransomware group. The investigation is ongoing, and Van der Stap is expected to appear in court today. 80 sources 70

Extracted Entities

Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Companies (1)

Countries (1)

CVEs (1)

CWE Weaknesses (1)

Industries (1)

Platforms (1)

Ransomware Groups (1)