Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation – Krebs on Security

Dutch authorities have detained a 23-year-old previously convicted cybercriminal, reportedly Pepijn van der Stap, over suspected ties to data theft and extortion operations run by the ShinyHunters collective. Shortly after this arrest, the remaining members of ShinyHunters escalated their activity sharply, breaching the FBI's job-application portal (apply.fbijobs.gov) and exposing sensitive personal and medical data on thousands of bureau staff, while also attempting to extort the Russian ransomware crew Cl0p. The FBI intrusion reportedly relied on CVE-2026-35273, a now-patched flaw in Oracle's PeopleSoft HR platform, which attackers allegedly exploited as a zero-day and later bypassed Mandiant's recommended WAF mitigations using a URL-encoding trick, affecting numerous organizations beyond the FBI. Sources suggest internal rivalry within the ShinyHunters/Scattered Lapsus Hunters ecosystem, including a teenager known as Rey, may be driving the group's riskier recent targeting, with some clues pointing toward Odido and AWS GovCloud-related infrastructure as well.