Dutch Arrest in ShinyHunters Probe Followed by FBI Breach Claim and Cl0p Targeting

Dutch police arrested a 24-year-old Amsterdam man on Sept. 15, 2026. The investigation targets the hacking group ShinyHunters. Outlets identified the suspect as Pepijn van der Stap, previously known by the handle Umbreon.

Days later, ShinyHunters claimed it breached the FBI’s own job-application site. The group also went after the ransomware gang Cl0p. Researchers say that timing was not a coincidence.

Van der Stap is a repeat player. A Dutch court convicted him in 2023 for data thefts and extortions. Prosecutors said the scheme netted between 1.5 million and 2.7 million euros.

He got four years, with one suspended. He walked out in December 2025. He then took a job as offensive security lead at Neo Security, after earlier stints at Hadrian and the nonprofit DIVD.

The FBI breach, and a number that won't settle

ShinyHunters claimed it stole Social Security numbers and personal data from apply.fbijobs.gov. 404 Media and Reuters reported the group said the haul covered data on more than 5,000 officials.

A separate report put the number far higher, at roughly 38,000 Bureau staff and applicants. The FBI has not confirmed either figure publicly. Treat both as estimates, not fact.

The group says it got in through CVE-2026-35273, a flaw in Oracle’s PeopleSoft software. PeopleSoft runs HR and payroll systems at government agencies, hospitals and universities nationwide. Oracle has issued a patch for the flaw, according to reporting on the breach.

ShinyHunters claims it used the bug as a zero-day — meaning undisclosed and unpatched — starting in June 2026, before that fix shipped. If your organization runs PeopleSoft, check Oracle’s advisory for CVE-2026-35273 and confirm you have installed the patch.

On Sept. 25, 2026, Google Threat Intelligence Group and Mandiant reported more. A cluster they track as UNC6240 exploited that same flaw using a URL-encoding trick. The trick disguised malicious traffic so firewall rules built to block the bug let it through anyway.

The lesson: patching matters more than firewall rules here. Don’t rely on a web application firewall to cover for an unpatched system.

A signature, or a setup?

Whoever defaced the FBI site left ASCII art of Umbreon, the Pokemon character. That’s the same alias Van der Stap once used.

Sources say that image may have been planted on purpose, to point fingers at him. That theory remains unconfirmed. ShinyHunters denies the arrested man has anything to do with the group at all.

This site has been seized by ShinyHunters. rooting your systems since '19 😉

ShinyHunters, krebsonsecurity.com

The Hacker News reported ShinyHunters publicly called the arrest a Dutch police attempt to seek attention, pointing to the Odido hack embarrassment. Hive Security reported the same denial.

The Hacker News also reported ShinyHunters says the FBI hack wasn’t about money. The group called it a messaging move, not extortion. Take that with a grain of salt — this group’s business model is extortion, and people describing their own motives aren’t evidence.

Why the arrest may have backfired

Sources close to the investigation told Krebs and Security Affairs that ShinyHunters is currently run by a young cybercriminal based in Amman, Jordan, who goes by the alias Rey. Threat intelligence firm KELA first publicly identified Rey in March 2025.

Researchers describe Rey as part of a hybrid crew called ScatteredLapsussHunters. That group blends tactics from Scattered Spider, LAPSUS$ and ShinyHunters. Rey has not been charged. The identification rests on researcher and source reporting, not a confirmed indictment.

Sources say Rey and Van der Stap had been fighting over control of the ShinyHunters name and its stolen data. The FBI and Cl0p hits were a sharp break from the group’s usual, more careful playbook, according to those same sources.

If that account holds, this isn’t a gang reeling from a police hit. It’s a leadership dispute spilling into public view, with the FBI caught in the crossfire. That framing comes from people close to the investigation and has not been independently confirmed by law enforcement.

ShinyHunters has a history of turning on partners. Wired reported the group and ScatteredLapsussHunters-affiliated hackers briefly worked with a smaller crew called TeamPCP to monetize stolen credentials, before ShinyHunters allegedly broke off that arrangement and ran its own extortions without sharing proceeds. Breach Signal has not independently verified TeamPCP’s identity or the details beyond what Wired reported.

The money behind the chaos

Mandiant researcher Austin Larsen estimated that ShinyHunters will pull in close to $100 million in extortion payments from its victims this year, according to Krebs and Security Affairs reporting.

The Hacker News reported FBI Assistant Director Brett Leatherman’s estimate separately. Leatherman said the suspect and his associates allegedly breached more than 140 organizations and extorted at least $70 million since last year. A favorite target, he said: third-party vendors riding on cloud platforms.

FBI Director Kash Patel called the arrested man one of ShinyHunters’ alleged leaders. The bureau said it is actively pursuing new leads generated by the arrest. That claim sits directly against ShinyHunters’ denial, and against a separate, unresolved dispute over an earlier hack.

The Odido wrinkle

Back in February 2026, ShinyHunters breached Dutch telecom Odido. The method: a phone call that talked an employee into entering credentials on a fake login page. The breach exposed data on more than 6.2 million people.

DataBreaches.Net and someone close to Van der Stap say a recorded voice from that Odido call doesn’t match his. Dutch police, for their part, say the Sept. 15 arrest of Van der Stap is not connected to the Odido hack at all — meaning the same man is tied to one case by voice evidence his associates dispute, and explicitly cleared by police of the other. That gap in the story is still unresolved.

DIVD, the nonprofit where Van der Stap once volunteered, separately disclosed its own security incident involving suspected malicious use of AI. A spokesperson said it doesn’t appear connected to ShinyHunters or any former volunteer.

A Rotterdam court has since ordered 90 more days of detention for the suspect, according to Associated Press reporting cited by Hive Security.

What to watch

Watch for the FBI to settle on a real victim count. A gap between 5,000 and 38,000 is too wide to leave open.

Watch whether PeopleSoft customers patch CVE-2026-35273 instead of leaning on firewalls alone. Watch the Rey-versus-Van der Stap feud, as reported by sources close to the investigation. Group infighting like this tends to spill into more leaks, not fewer.

If you worked at or applied to the FBI recently, your data may be among what ShinyHunters claims to have taken from apply.fbijobs.gov. Watch for phishing emails or texts that reference job applications, background checks or federal hiring. That’s exactly what stolen HR data gets used for.

And if someone calls claiming to be IT support and asks you to log in on a link, like the trick that hit Odido employees, end the call. Call your IT department directly. Real IT teams don’t ask for your password over the phone.