Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation

Dutch authorities announced the arrest of a 24-year-old man from Amsterdam suspected of ties to the ShinyHunters extortion crew. The suspect, reportedly Pepijn van der Stap, had already been convicted in 2023 for hacking intrusions, data theft and extortion, and was arrested again on September 16 while still on supervised release. Journalist Brian Krebs notes that the group's current leader, a teenager going by "Ray" from ScatteredLapsussHunters, may have deliberately pinned ShinyHunters' recent breach of an FBI jobs site on van der Stap — an intrusion that reportedly leveraged a modified exploit for the Oracle PeopleSoft flaw CVE-2026-35273, previously abused as a zero-day. Van der Stap, who now works in offensive security, is also not believed to be the voice behind the social-engineering call that led to the massive Odido data breach affecting 6.2 million customers; he is due in court the same day as the police statement.