The Dutch police have confirmed the arrest of an individual suspected of being associated with the ShinyHunters extortion group.
“This month a 24-year-old man from Amsterdam was indeed arrested in an investigation into the hacker group ShinyHunters,” the Dutch police said on Monday.
The suspect is believed to be Pepijn van der Stap, a hacker convicted in 2023 for multiple intrusions followed by data theft and extortion.
Investigative journalist Brian Krebs reports that prior to his conviction, van der Stap used the online hacker handle Umbreon in his extortion activities while working as a software engineer at cybersecurity startup Hadrian.
When arrested on September 16, the 24-year-old was on supervised release after serving three years of his four-year prison sentence. He is now employed as offensive security lead at Neo Security.
According to Krebs, ShinyHunters’ recent FBI hack appears to have been pinned on van der Stap by the group’s current leader, a teenage cybercriminal from Amman, Jordan, nicknamed Ray, who is also a part of the ScatteredLapsussHunters hacking group.
ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273, the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement.