Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/09/dutch-police-arrest-24-year-old.html

ONE SENTENCE SUMMARY:

Dutch police arrested alleged ShinyHunters member Pepijn van der Stap as group claims FBI jobs hack via WAF bypass recently.

MAIN POINTS:

1. Authorities confirmed arrest of a 24-year-old Amsterdam man tied to ShinyHunters investigations.
2. Police stated the suspect will appear at Rotterdam District Court on September 29, 2026.
3. Journalists Brian Krebs and DataBreaches.Net identified him as Pepijn van der Stap “Umbreon.”
4. Reports say the arrest occurred September 15, 2026, though officials withheld specifics.
5. Earlier, he was apprehended in 2023 for data theft and extortion activities.
6. Employment history included cybersecurity firm Hadrian and volunteering with the Dutch DIVD.
7. Van der Stap described intense paranoia from maintaining appearances while balancing lawful and illegal work.
8. LinkedIn lists him as offensive security lead at Dutch company Neo Security.
9. ShinyHunters claimed responsibility for hacking apply.fbijobs.gov and stealing terabytes of sensitive data.
10. Investigators now assess a URL-encoding WAF bypass for CVE-2026-35273, not an Oracle PeopleSoft zero-day.

TAKEAWAYS:

1. Dual-role security professionals can present elevated insider-risk and vetting challenges.
2. Criminal groups may stage high-profile breaches as “marketing” to shape narratives and attention.
3. Treat announced “zero-days” skeptically until validated by technical evidence and independent assessment.
4. Web application firewalls remain vulnerable to evasion techniques like encoding tricks and rule bypasses.
5. Defensive teams should prioritize monitoring for large-scale exfiltration from public-facing recruitment portals.