Reported by 15 outlets

Timeline

1. original reporting

   Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

   malware.news · 15d ago · September 28th, 2026

   Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters . In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p . According to three sources familiar with the matter, the Dutch man arrested by authorities this month is Pepijn van der Stap , a convicted cybercriminal from Almere and Leylstad in the Netherlands. Van der Stap was previously convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. At his trial in late 2023, van der Stap admitted that he lived a Dr. Jekyll and Mr. Hyde existence, secretly using the hacker handle “ Umbreon ” to extort victims and post their data on English language hacking communities like the now-defunct RaidForums and Breached. By day, however, van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian , while volunteering at the Dutch Institute for Vulnerability Dis

2. update from wired.com

   ShinyHunters Is a Hacking Group on a Data Breach Spree (Wired, first profile of the group)

   wired.com · 2337d ago · May 21st, 2020

   Wired published the first profile of ShinyHunters two weeks after the group surfaced, hawking claimed close to 200 million stolen records from at least 13 companies: 91 million Tokopedia accounts, roughly 22 million Unacademy accounts, and data from Zoosk, Home Chef, Minted, and others, promoted on RaidForums and the Empire dark web market as "Stage 1". Day-level date taken from the article dateline, which shows May 21, 2020 8:00 AM without a timezone.

3. update from techcrunch.com

   US, French authorities confirm arrest of BreachForums hackers (TechCrunch)

   techcrunch.com · 474d ago · June 26th, 2025

   Paris prosecutor Laure Beccuau said French police arrested four people suspected of running BreachForums and being part of a collective called ShinyHunters, while the US Justice Department separately indicted British national Kai West (IntelBroker), arrested in France in February. This was the previous arrest wave against the same collective, 15 months before the Dutch arrest in this story.

4. update from krebsonsecurity.com

   ShinyHunters Wage Broad Corporate Extortion Spree (KrebsOnSecurity)

   krebsonsecurity.com · 372d ago · October 7th, 2025

   ShinyHunters (tracked by Google as UNC6040) launched the Scattered LAPSUS$ Hunters extortion blog threatening to publish Salesforce data from more than three dozen companies including Toyota, FedEx, Disney/Hulu, and UPS, and claimed breaches of a Red Hat GitLab server holding over 28,000 repositories and of Discord user data. The same post reports KrebsOnSecurity receiving malware-laced threats carrying an ASYNCRAT backdoor. Day-level date; the page shows October 7, 2025 6:45 PM site time without a timezone.

5. update from krebsonsecurity.com

   Meet Rey, the Admin of 'Scattered Lapsus$ Hunters' (KrebsOnSecurity)

   krebsonsecurity.com · 322d ago · November 26th, 2025

   KrebsOnSecurity identified Rey, one of three administrators of the Scattered LAPSUS$ Hunters Telegram channel and operator of the ShinySp1d3r ransomware-as-a-service offering, as a 15-year-old from Amman, Jordan, via infostealer data and opsec errors. The post also documents the group's Telegram offers to recruit insider employees at large companies, and the FBI's October 5, 2025 seizure of BreachForums domains.

6. update from krebsonsecurity.com

   Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation

   krebsonsecurity.com · 15d ago · September 28th, 2026

   Pepijn van der Stap’s alter ego “Umbreon” selling a database on RaidForums, offering information on 2.3 million people from The Netherlands in September 2021. This user’s avatar is a depiction of the Pokemon character Umbreon.

7. mentioned by krebsonsecurity.com

   🤖 Dutch police arrested a 23-year-old convicted cybercriminal suspected of aiding ShinyHunters data thefts and extortions. In the days after

   krebsonsecurity.com · 15d ago · September 28th, 2026

8. update from malware.news

   Still on probation from previous arrest for hacking and extortion, Dutch national is arrested again

   malware.news · 15d ago · September 28th, 2026

   In June 2023, DataBreaches reported on the arrest of a young Dutch national who was a highly respected “white hat” by day but also a prolific “black hat.” History seems to have repeated itself. has been arrested once again for criminal activities.

9. update from desnips.nl

   Security expert Pepijn van der S. arrested for the megahack at Odido (ShinyHunters)

   desnips.nl · 15d ago · September 28th, 2026

   Security expert Pepijn van der S. arrested for the megahack at Odido #Odidohack

   via Mastodon https://desnips.nl/e57c759-Odido-hack-ShinyHunters/

10. mentioned by hackread.com

    ⚠️📢 Dutch police have arrested a 23-year-old suspect in the ShinyHunters investigation into the Odido breach. Sources identify him as a prev

    hackread.com · 15d ago · September 28th, 2026

11. update from bleepingcomputer.com

    Dutch police confirm arrest in ShinyHunters hacking investigation

    bleepingcomputer.com · 15d ago · September 28th, 2026

    "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," the Politie Landelijke Opsporing en Interventies said Monday. Police said the suspect will appear before the Rotterdam District Court on Tuesday, September 29, when further information will also be released. He later pleaded guilty and was sentenced to four years in prison, with one year suspended, followed by a three-year probationary period with additional conditions. The report also states that the "Umbreon" identity previously used by Van der Stap could link him to ShinyHunters, which recently used the same Pokémon

12. mentioned by www.bleepingcomputer.com

    Dutch police confirm arrest in ShinyHunters hacking investigation https:// bleepingcomputer.com/news/security/ dutch-police-confirm-arrest-i

    www.bleepingcomputer.com · 15d ago · September 28th, 2026

13. update from ibtimes.co.uk

    Convicted Hacker Umbreon Arrested on Suspicion of Aiding ShinyHunters as Group Claims FBI Hack

    ibtimes.co.uk · 15d ago · September 28th, 2026

    submitted by /u/Mean-Industry7032 [link] [comments]

    via reddit r/cybersecurity: Convicted Hacker Umbreon Arrested on Suspicion of Aiding ShinyHunters as Group Claims FBI Hack

14. update from securityweek.com

    Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

    securityweek.com · 14d ago · September 29th, 2026

    He is now employed as offensive security lead at Neo Security. According to Krebs, ShinyHunters’ recent FBI hack appears to have been pinned on van der Stap by the group’s current leader, a teenage cybercriminal from Amman, Jordan, nicknamed Ray, who is also a part of the ScatteredLapsussHunters hacking group. ShinyHunters hacked the FBI jobs site, likely using a modified exploit for CVE-2026-35273 , the Oracle PeopleSoft vulnerability, which the group exploited as a zero-day in June, and included an oversized Umbreon Pokémon image in the site’s defacement. In early September, Dutch police asked for the public’s help in identifying the voice in the audio recording of

15. update from cyberscoop.com

    Alleged ShinyHunters leader arrested in the Netherlands

    cyberscoop.com · 14d ago · September 29th, 2026

    Authorities arrested an alleged leader of ShinyHunters, the notorious cybercrime group responsible for a string of high profile extortion attacks since 2025, including last week’s attack on the FBI . Officials haven’t named the accused man, but independent cybersecurity journalist Brian Krebs identified him as Pepjin van der Stap , a previously convicted cybercriminal who moonlighted as a cybersecurity professional. The arrest, which occurred about a week before ShinyHunters claims it broke into FBI systems and stole reams of data containing sensitive information on almost every FBI agent , marks a major development for global law enforcement’s push to track down and arrest the group’s members. “Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement on YouTube Tuesday. “They often target third-party vendors in cloud-based platforms, stealing sensitive data and extort victims with threats to publish it.” The Dutch National Police said they retrieved a large amount of evidence on van der Stap’s laptop, including details about two murders he allegedly ordered abroad. As the investigation continues, a court in Rotterdam ordered him to remain detained awaiting tr

16. update from malware.news

    FBI warns ShinyHunters members to come forward after alleged leader’s arrest

    malware.news · 14d ago · September 29th, 2026

    The FBI’s top cyber official on Tuesday warned remaining ShinyHunters members to contact investigators while they still have a choice, suggesting authorities could have made undisclosed progress against the hacking group that recently claimed to have stolen troves of highly sensitive bureau personnel records. “You know how to find us, and we know how to find you,” Brett Leatherman, assistant director of the FBI’s Cyber Division, said in a https://m.youtube.com/watch?v=bxLNRd7WvzU ”>YouTube video posted by the bureau. “I suggest you reach out first while the choice is still yours.” Leatherman’s remarks accompanied Dutch authorities’ announcement Tuesday that they had https://www.politie.nl/nieuws/2026/september/29/11-verdachte-aangehouden-in-onderzoek-naar-hackersgroep-shinyhunters.html ”>arrested an alleged leader of the group. “We’re confident you’ve seen or heard things in recent days that the public has not,” Leatherman said, addressing the remaining members. “Other groups believed anonymity or their friends would protect them, and t

17. mentioned by krebsonsecurity.com

    # Dutch Police Arrest ‘Reformed’ Hacker in # ShinyHunters Investigation https:// krebsonsecurity.com/2026/09/du tch-police-arrest-reformed-h

    krebsonsecurity.com · 14d ago · September 29th, 2026

18. update from malware.news

    Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders

    malware.news · 14d ago · September 29th, 2026

    Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far.

19. update from bleepingcomputer.com

    FBI tells ShinyHunters members to turn themselves in after recent arrest

    bleepingcomputer.com · 14d ago · September 29th, 2026

    "There are indications that the suspect gave the order for this." The Rotterdam District Court ruled Tuesday that the suspect will remain in pre-trial detention for at least another 90 days, while police said further arrests have not been ruled out. ShinyHunters frequently targets corporate SSO accounts , third-party vendors , and cloud-based SaaS platforms, such as Salesforce and Snowflake , to steal sensitive data before extorting victims wit

20. update from www.bleepingcomputer.com

    FBI tells ShinyHunters members to turn themselves in after recent arrest https:// bleepingcomputer.com/news/security/ fbi-tells-shinyhunters

    www.bleepingcomputer.com · 14d ago · September 29th, 2026

    FBI tells ShinyHunters members to turn themselves in after recent arrest https:// bleepingcomputer.com/news/security/ fbi-tells-shinyhunters

    via X https://www.bleepingcomputer.com/news/security/fbi-tells-shinyhunters-members-to-turn-themselves-in-after-recent-arrest/

21. mentioned by hackread.com

    ⚠️📢 Dutch police say a 24-year-old suspect in the # ShinyHunters investigation is also suspected of trying to arrange two murders abroad. Po

    hackread.com · 14d ago · September 29th, 2026

22. update from tinyurl.com

    🚨 A Dutch hacker linked to ShinyHunters, who attacked the FBI and Rockstar Games, was arrested. It’s like catching a thief before they steal

    tinyurl.com · 14d ago · September 30th, 2026

    🚨 A Dutch hacker linked to ShinyHunters, who attacked the FBI and Rockstar Games, was arrested. It’s like catching a thief before they steal

    via Mastodon https://tinyurl.com/2yd36ykv

23. update from gbhackers.com

    FBI, Dutch Police Take Down Alleged ShinyHunters Cybercrime Group Leader

    gbhackers.com · 14d ago · September 30th, 2026

    This development marks a significant step forward in an international investigation into a widespread data theft and extortion operation.

24. update from cyberpress.org

    FBI and Dutch Police Arrest Alleged ShinyHunters Leader Linked to 140 Cyberattacks

    cyberpress.org · 13d ago · September 30th, 2026

    The Dutch National Police’s High Tech Crime Unit carried out the operation in coordination with FBI investigators. FBI Director Kash Patel said the suspect was arrested under Dutch law and described the individual as one of ShinyHunters’ alleged leaders. FBI and Dutch Police Arrest Alleged ShinyHunters Leader Patel said FBI teams are continuing to work with international and private-sector partners to develop and execute further investigative leads arising from the arrest. The case highlights the international reach of ShinyHunters, a cyber-extortion operation associated with large-scale data theft, victim harassment, and threats to publicly release stolen information.

25. mentioned by theperimetersite.com

    The Dutch police have a 24-year-old man from Amsterdam in custody. His name is Pepijn van der Stap, and he is allegedly a member of ShinyHun

    theperimetersite.com · 13d ago · September 30th, 2026

26. update from krebsonsecurity.com

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests

    krebsonsecurity.com · 6d ago · October 7th, 2026

    KrebsOnSecurity has learned that the suspect, who uses the hacker handle “ Rey ,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing , which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines . The logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing. On October 3, Reuters cited three unnamed sources saying a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI.

27. update from krebsonsecurity.com

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests https:// krebsonsecurity.com/2026/10/sh inyhunters-extorted-boeing-spin-off-prior-to-

    krebsonsecurity.com · 6d ago · October 7th, 2026

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests https:// krebsonsecurity.com/2026/10/sh inyhunters-extorted-boeing-spin-off-prior-to-

    via Mastodon https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/

28. mentioned by krebsonsecurity.com

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests Source: Krebs on Security Read: https:// krebsonsecurity.com/2026/10/sh inyhunters-ex

    krebsonsecurity.com · 6d ago · October 7th, 2026

29. mentioned by krebsonsecurity.com

    (krebsonsecurity.com) ShinyHunters Leader Detained: Inside the Cybercrime Group’s Extortion Spree and FBI Cooperation In brief - This articl

    krebsonsecurity.com · 6d ago · October 7th, 2026

30. update from zubiqo.com

    Authorities arrested the teen running the ShinyHunters extortion brand while he targeted a former Boeing aviation unit sold for $10.55B. He

    zubiqo.com · 6d ago · October 7th, 2026

    Authorities arrested the teen running the ShinyHunters extortion brand while he targeted a former Boeing aviation unit sold for $10.55B.

31. mentioned by krebsonsecurity.com

    New. The continuing saga of the not-so-shiny Hunters. KrebsonSecurity: ShinyHunters Extorted Boeing Spin-off Prior to Arrests https:// krebs

    krebsonsecurity.com · 6d ago · October 7th, 2026

32. mentioned by krebsonsecurity.com

    🗞 ShinyHunters Extorted Boeing Spin-off Prior to Arrests via Krebs on Security https:// krebsonsecurity.com/2026/10/sh inyhunters-extorted-b

    krebsonsecurity.com · 5d ago · October 8th, 2026

33. mentioned by krebsonsecurity.com

    # ShinyHunters Extorted # Boeing Spin-off Prior to Arrests https:// krebsonsecurity.com/2026/10/sh inyhunters-extorted-boeing-spin-off-prior

    krebsonsecurity.com · 5d ago · October 8th, 2026

34. mentioned by krebsonsecurity.com

    🗞 Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation via Krebs on Security https:// krebsonsecurity.com/2026/09/du tch-pol

    krebsonsecurity.com · 4d ago · October 9th, 2026