On September 28, 2026, Dutch police arrested 24-year-old Pepijn van der Stap, the offensive security lead at Amsterdam-based Neo Security and a previously convicted cybercriminal known as “Umbreon,” on suspicion of aiding the prolific ShinyHunters hacking collective.
The Arrest of Pepijn van der Stap and the Flashbang Raid in Amsterdam
Dutch law enforcement descended on the Amsterdam office of cybersecurity firm Neo Security on the night of September 15, 2026, executing a dramatic raid involving flashbang grenades to detain 24-year-old Pepijn van der Stap. Benjamin Korper, the executive at Neo Security who hired van der Stap, confirmed that forensic investigators swept the premises following the operation. Van der Stap, a resident of Almere and Lelystad, had previously served time for a multi-million-euro extortion and data theft spree before his release in December 2025. He had actively recast his public profile as a reformed researcher striving to make amends, even taking a role as offensive security lead.
Despite those rehabilitation claims, investigators locked onto van der Stap over suspected ongoing ties to ShinyHunters. Dutch authorities confirmed that the suspect will appear before the chambers of the Rotterdam District Court on Tuesday, September 29, 2026. Korper admitted that while he thoroughly vetted van der Stap prior to hiring him, external security audits launched immediately after the raid revealed no evidence that Neo Security or its clients had been compromised by the employee.
ShinyHunters Escalates Attacks and Targets the FBI
Within days of the raid, the group claimed credit for a sweeping breach at apply.fbijobs.gov, the bureau’s employment portal. Utilizing an exploited zero-day vulnerability in Oracle’s PeopleSoft human resources platform tracked as CVE-2026-35273, the attackers exfiltrated massive troves of sensitive personnel data.
https://x.com/Pol_Ops_Int/status/2104607979559342174
Security firms Mandiant and the Google Threat Intelligence Group confirmed that the collective bypassed deployed web application firewall rules using a clever URL-encoding trick. Internal agency memos revealed that the FBI operated under the sobering presumption that the attackers compromised personal details belonging to every single bureau employee. The stolen datasets included Social Security numbers, detailed intelligence assignments, medical files, and psychiatric notes concerning special agents and cybercrime unit examiners.
Internal Power Struggles and the Shadow of Rey
The recent pivot toward high-risk, high-profile targets like the FBI marks a radical departure from the group’s previous operational tempo. According to industry intelligence, the shift followed a hostile takeover of ShinyHunters by a teenage hacker from Amman, Jordan, known online as “Rey.” Rey operates within an amalgamated cybercrime collective designated as ScatteredLapsussHunters (SLSH), combining operatives from Scattered Spider, LAPSUS$, and ShinyHunters.
Investigators noted that Rey harbored intense animosity toward van der Stap regarding control over infrastructure and stolen data caches. When the group defaced the FBI job portal, they prominently displayed ASCII art of the Pokémon character Umbreon—van der Stap’s historic hacker moniker. Cybersecurity analysts concluded that Rey deliberately planted the imagery to frame the Dutch engineer and direct federal attention squarely toward him.
The Response from ShinyHunters and Impending Court Proceedings
In public statements disseminated through messaging channels and social media, ShinyHunters aggressively dismissed the police action while mocking Dutch law enforcement capabilities. The collective claimed that van der Stap maintained no active association with their operations, writing that the Dutch police are entirely incompetent and irrelevant. Simultaneously, the group softened initial threats directed at federal investigators, stating that a previously announced deadline regarding FBI threat advisories was not an active warning.
As van der Stap prepares for his court appearance in Rotterdam, cybersecurity analysts and cloud security architects continue to parse the wider fallout from the PeopleSoft supply chain compromise.
