Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

Summary

Dutch police have arrested Pepijn van der Stap, a 24-year-old man suspected of being associated with the ShinyHunters extortion group. Van der Stap was previously convicted in 2023 for data theft and extortion and was on supervised release. He is believed to be linked to the ShinyHunters hack of the FBI jobs site, potentially using an exploit for CVE-2026-35273. The arrest comes amid ongoing investigations into ShinyHunters' activities, including a social engineering attack targeting Odido.

Full text

The Dutch police have confirmed the arrest of an individual suspected of being associated with the ShinyHunters extortion group. “This month a 24-year-old man from Amsterdam was indeed arrested in an investigation into the hacker group ShinyHunters,” the Dutch police said on Monday. The suspect is believed to be Pepijn van der Stap, a hacker convicted in 2023 for multiple intrusions followed by data theft and extortion. Investigative journalist Brian Krebs reports that prior to his conviction, van der Stap used the online hacker handle Umbreon in his extortion activities while working as a software engineer at cybersecurity startup Hadrian. When arrested on September 16, the 24-year-old was on supervised release after serving three years of his four-year prison sentence. He is now employed as offensive security lead at Neo Security. According to Krebs, ShinyHunters’ recent FBI hack appears to have been pinned on van der Stap by the group’s current leader, a teenage cybercriminal from Amman, Jordan, nicknamed Ray, who is also a part of the ScatteredLapsussHunters hacking group.Advertisement. Scroll to continue reading. ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273, the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement. In early September, Dutch police asked for the public’s help in identifying the voice in the audio recording of a social engineering attack targeting the telecommunications provider Odido, which resulted in the theft of 6.2 million people’s data. ShinyHunters reportedly confirmed that one of its members made the call, but said the police would not be able to link it to a real person. According to DataBreaches, the voice in the audio clip is not van der Stap’s. On Monday, the Dutch police said the suspect arrested earlier this month is scheduled to appear in court today and promised additional information after the hearing. Related: Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon Related: Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court Related: US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire DC Health Agency Exposes 400,000 Beneficiary RecordsGoogle Warns of ShinyHunters’ Fresh Oracle PeopleSoft CampaignKiteworks Urges Server Shutdown, Finds Advanced Forms VulnerabilityNew x47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingKosovar Owner of Rydox Marketplace Pleads Guilty in US Court‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationRoundcube Webmail Vulnerability in Attackers’ CrosshairsKontext Security Emerges With $4 Million for AI Agent Runtime Controls Latest News Rig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity RisksFour Cyber Threats Harboring Big Plans for the FutureOpenAI Calls Off GPT-6.1 Astra Launch, Details Safety Cases for Frontier TrainingDaemon Tools Hackers’ NeedyMantis Malware Dissected by MicrosoftApple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ Modulate Raises $25 Million to Advance Deepfake DetectionCall for Presentations Open for 2026 CISO Forum Virtual SummitPrison Sentence for Former US Soldier Who Hacked AT&T and Verizon Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveDoppel has named Joey Rachid as Chief Security Advisor and Field Chief Information Security Officer.Delinea has appointed Timothy Regan as Chief Financial Officer.Gwen Gann has become State Chief Information Security Officer for the State of Washington at WaTech.More People On The MoveExpert Insights Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-35273

Entities