Authorities in the Netherlands have arrested Pepijn van der Stap, a 24-year-old convicted cybercriminal, on suspicion of aiding the prolific hacker group ShinyHunters in data thefts and extortions. The arrest of van der Stap, known online as "Umbreon," occurred around September 16th, with remaining ShinyHunters members reportedly escalating their attacks immediately afterward, targeting the FBI and even extorting the Russian ransomware group Cl0p. Van der Stap, from Almere and Lelystad, was previously convicted in 2023 for a string of data thefts and extortions that prosecutors estimated netted between €1.5 million and €2.7 million. During his trial, van der Stap confessed to a dual life, operating as "Umbreon" to extort victims and leak their data on forums like RaidForums and Breached, while simultaneously working as a software engineer at Amsterdam-based cybersecurity startup Hadrian and volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD). He was sentenced to four years in prison, with one year suspended, and released in December 2025. In a September 9, 2026 interview with KrebsOnSecurity, van der Stap presented himself as a reformed individual striving to contribute positively to society, employed as the offensive security lead at Neo Security. However, shortly after this interview, he ceased communication, prompting concerns among those close to him. Sources familiar with the investigation confirm van der Stap’s arrest and detention for questioning, with evidence suggesting authorities removed items from his residence. The Dutch police have been actively seeking public assistance in identifying a ShinyHunters member’s voice involved in a February 2026 social engineering attack on Odido, the Netherlands’ largest mobile provider, which resulted in the theft of data belonging to over 6.2 million Dutch citizens. ShinyHunters confirmed the individual in the audio clip was a member, pledging full support and criticizing the Dutch police as "a big joke; they are incapable of doing anything." The group’s recent high-profile attacks, including a breach of the FBI’s job application site (apply.fbijobs.gov), have been attributed to a shift in operations following a takeover by a teenage cybercriminal from Jordan known as "Rey," who operates as part of the ScatteredLapsussHunters (SLSH) group. Rey is believed to have orchestrated the FBI hack, reportedly exploiting a vulnerability (CVE-2026-35273) in Oracle’s PeopleSoft software, and used the Umbreon avatar in the defacement message as a likely attempt to frame the Dutchman. The FBI confirmed the breach, which exposed personal information, including Social Security numbers and sensitive medical files, of over 5,000 officials. ShinyHunters’ exploitation of the PeopleSoft vulnerability was further amplified by their use of a URL-encoding trick to bypass web application firewall rules designed to mitigate the threat. Mandiant and Google Threat Intelligence Group (GTIG) confirmed mass exploitation of this vulnerability across various sectors. The conflict between SLSH and ShinyHunters reportedly stems from a failed partnership earlier in 2026 with TeamPCP, a group specializing in supply chain compromises. ShinyHunters allegedly went "rogue," extorting victims with TeamPCP’s credentials without sharing profits, leading to mutual blame after Mandiant interfered with TeamPCP’s data monetization efforts. Mandiant researcher Austin Larsen estimates ShinyHunters is on track to generate nearly $100 million in extortion payments in 2026. Van der Stap, however, has claimed his past activities were driven by a desire to amass the world’s most comprehensive collection of stolen databases rather than financial gain, telling Bloomberg in 2024 that hacking was "very easy" and his "habit was collecting." Meanwhile, DIVD, where van der Stap previously volunteered, disclosed an internal cybersecurity incident possibly involving AI, though they stated it does not appear related to ShinyHunters or his past work. An update from Dutch police confirmed the arrest of a 24-year-old in connection with the ShinyHunters investigation, with the suspect scheduled to appear before the Rotterdam District Court on September 29th.