The Double Life of Umbreon: How a Dutch Cybersecurity Whiz Became the Center of a Global Cyber-War

In a case that blurs the lines between professional security research and high-stakes international cybercrime, Dutch authorities have arrested 24-year-old Pepijn van der Stap. A convicted cybercriminal who once balanced a legitimate career in cybersecurity with a dark, secondary life as a prolific hacker, van der Stap is now at the heart of an escalating global conflict involving the FBI, international ransomware syndicates, and the notorious hacking collective known as "ShinyHunters."

The arrest, which took place in the Netherlands in mid-September 2026, has acted as a catalyst for a chaotic series of retaliatory cyberattacks. In the days following his detention, ShinyHunters—a group known for massive data thefts and high-profile extortions—launched a series of brazen assaults against American federal infrastructure and Russian-linked ransomware gangs, marking a shift from calculated theft to aggressive, scorched-earth digital warfare.

The Jekyll and Hyde of Almere

The suspect, Pepijn van der Stap, is a figure of stark contradictions. A resident of Almere and Lelystad, van der Stap was previously convicted in 2023 for a series of data thefts that prosecutors estimated netted between €1.5 million and €2.7 million. During his trial, van der Stap described a "Dr. Jekyll and Mr. Hyde" existence: by day, he was a respected software engineer at the Amsterdam-based cybersecurity startup Hadrian and a volunteer for the Dutch Institute for Vulnerability Disclosure (DIVD). By night, he operated under the handle "Umbreon," infiltrating networks and offloading stolen data on forums like the now-defunct RaidForums and Breached.

Van der Stap’s criminal career is characterized by an obsessive desire to curate data. Unlike hackers motivated solely by financial gain, he famously told Bloomberg in 2024 that his primary drive was "collecting data, organizing data, downloading data, creating folders." Despite this, his activities led to a four-year prison sentence, of which one year was suspended. He was released in December 2025, claiming at the time that he was a reformed individual dedicated to making amends.

However, investigators believe that while he was employed as an offensive security lead at Neo Security in 2026, he never truly abandoned his roots. Dutch police have been actively hunting the individual responsible for a February 2026 breach of Odido, the Netherlands’ largest mobile telecommunications provider, which resulted in the theft of personal data from 6.2 million Dutch citizens.

A Chronology of Escalation

The situation spiraled out of control in September 2026, following a series of events that investigators are still piecing together:

• September 7, 2026: Dutch police release an audio clip of a suspect involved in the Odido hack, seeking public assistance in identifying the voice. ShinyHunters publicly confirms the suspect is a member of their collective, offering legal and financial support while labeling the Dutch police as "incompetent" and "useless."
• September 16, 2026: Dutch authorities arrest van der Stap. Sources confirm that police were seen removing hardware and documents from his residence.
• Late September 2026: Shortly after the arrest, ShinyHunters launches a high-profile attack on the FBI’s job application portal (apply.fbijobs.gov), leaking the sensitive data of over 5,000 officials, including medical and psychiatric records.
• September 29, 2026: The Dutch outlet RTL reports that investigators have added a chilling new charge: suspicion of orchestrating at least two murders to be carried out abroad.

The "Rey" Factor: A New Era of Cybercrime

The rapid escalation of ShinyHunters’ activities is largely attributed to a leadership vacuum and a subsequent takeover by a teenage cybercriminal from Amman, Jordan, known as "Rey." Rey is a key operative in ScatteredLapsusHunters (SLSH), an amalgamation of the infamous groups Scattered Spider, LAPSUS$, and ShinyHunters.

Sources close to the investigation suggest that Rey and van der Stap had a deep-seated rivalry over control of the ShinyHunters brand. The inclusion of the "Umbreon" ASCII art in the FBI job site defacement—a hallmark of van der Stap’s old persona—was likely a calculated move by Rey to frame the incarcerated Dutchman for the FBI breach.

This power struggle intensified after a failed partnership with "TeamPCP," an upstart supply-chain hacking group. According to reports, ShinyHunters betrayed their partners, unilaterally monetizing stolen credentials without sharing the proceeds. As credentials became "burned" due to intervention from Mandiant and major cloud providers, the groups began pointing fingers, leading to the current, volatile climate.

Implications for Global Security

The breach of the FBI portal was not merely a protest; it was a technical demonstration of power. ShinyHunters successfully exploited a vulnerability (CVE-2026-35273) in Oracle’s PeopleSoft platform. Despite patches and web application firewall (WAF) mitigations issued by Mandiant, ShinyHunters utilized a URL-encoding trick to bypass security measures.

Security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that this vulnerability was mass-exploited across diverse sectors, including healthcare, agriculture, and transportation. Estimates suggest that ShinyHunters is on a trajectory to generate nearly $100 million in extortion revenue throughout 2026, cementing their status as one of the most significant threats to global digital infrastructure.

Official Responses and the Road Ahead

The response from law enforcement has been firm. The FBI, through Assistant Director Brett Leatherman, released a video message emphasizing that the net is closing in. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left," Leatherman stated, directly addressing the remaining members of the collective.

In the Netherlands, the legal proceedings against van der Stap are expected to be lengthy. The revelation that he is now suspected of plotting murders, in addition to his cyber-activities, marks a terrifying intersection of digital espionage and violent crime.

For the cybersecurity community, the case of Pepijn van der Stap serves as a grim cautionary tale regarding the "insider threat" model. When individuals with deep technical knowledge and a penchant for "data hoarding" are not properly rehabilitated or monitored, the consequences can extend far beyond the theft of databases. As the Dutch authorities prepare for the trial on September 29, the world waits to see whether the capture of one man will truly cripple a global network of hackers, or if the vacuum left behind will simply invite further, more desperate acts of digital defiance.

The collapse of the hacker’s "reformed" facade has left his former employers, Neo Security and Hadrian, and his former volunteer organization, DIVD, to contend with the fallout. As the investigation continues, one thing remains clear: the era of the "lone hacker" is over, replaced by a complex, interconnected web of state-border-defying collectives that view the global security apparatus not as a threat, but as a target.