Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation

Dutch law enforcement has confirmed the arrest of a 24-year-old man from Amsterdam tied to an ongoing investigation into the ShinyHunters hacking collective. Police stated he is due to appear before the Rotterdam District Court on September 29, 2026, though officials have not released further case details. Journalists Brian Krebs and DataBreaches.Net have identified the suspect as Pepijn van der Stap, previously arrested in 2023 for data theft and extortion, who had worked at security firm Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure before later taking an offensive security role at Neo Security.

The arrest follows ShinyHunters' recent claim of breaching the FBI's job application portal, apply.fbijobs.gov, allegedly exfiltrating large volumes of sensitive data. The group insists the intrusion was not extortion or financially motivated, framing it instead as a demonstration. Investigators now believe the attackers did not use a genuine zero-day in Oracle PeopleSoft as claimed, but instead bypassed web application firewall protections meant to block exploitation of CVE-2026-35273 using a URL-encoding evasion technique.