Actor Profile

ShinyHunters is a cybercrime group known for large-scale data breaches and extortion operations. The group has been active since at least 2020, targeting organizations across multiple sectors to steal and leak sensitive data. Dutch law enforcement arrested a 24-year-old Amsterdam man, identified as Pepijn van der Stap (alias "Umbreon"), on September 15, 2026, as part of an investigation into possible connections with ShinyHunters. Van der Stap was previously convicted in 2023 for hacking and blackmailing over a dozen companies, receiving a four-year sentence with one year suspended. Authorities are examining potential links between Van der Stap's "Umbreon" persona and recent ShinyHunters operations, including an FBI breach and the defacement of Clop ransomware's leak site, both featuring the same Pokémon character imagery. ShinyHunters representatives have denied any association with the arrested individual.

TTPs (Tactics, Techniques, Procedures)

Based on the investigation details, ShinyHunters-linked activity demonstrates social engineering for initial access (T1598 - Phishing for Information), specifically through vishing/phone-based pretexting where attackers impersonated IT department staff to trick help desk employees. The threat actors employed credential harvesting via fake login pages (T1056.003 - Web Portal Capture) to obtain authentication credentials and verification codes, enabling unauthorized access to internal systems (T1078 - Valid Accounts). The group conducts data theft operations (T1530 - Data from Cloud Storage, T1005 - Data from Local System) followed by extortion and public data leaking. Recent operations also include website defacement (T1491.002 - External Defacement) as demonstrated in attacks against the Clop ransomware leak site.

Targets & Patterns

ShinyHunters has demonstrated a broad targeting profile across multiple sectors and geographies. Historical activity includes breaches of telecommunications providers (Odido in the Netherlands), government databases (Florida DMV "DAVID" system), healthcare organizations (Novocure affecting 1,400+ cancer patients), and even rival cybercrime infrastructure (Clop ransomware leak site, HackForums). The group appears motivated primarily by financial gain through data extortion and potential sale of stolen databases. Their willingness to target both legitimate organizations and criminal infrastructure suggests opportunistic targeting based on access opportunities rather than sector-specific focus. The group's operations span international boundaries, with confirmed victims in the Netherlands, United States, and globally. Their targeting of help desk personnel through social engineering indicates a focus on exploiting human vulnerabilities in organizational security chains.

Historical Context

ShinyHunters has been active since at least 2020, with the "Umbreon" Pokémon character appearing in a HackForums defacement that year. The arrested suspect, Pepijn van der Stap, used the "Umbreon" alias on BreachForums starting in 2021, though the temporal overlap raises questions about identity continuity. Van der Stap's criminal history includes a January 2023 arrest for hacking and blackmailing more than a dozen companies in the Netherlands and worldwide, resulting in a four-year prison sentence (one year suspended) and three-year probationary period. His September 2026 re-arrest occurred during his probationary period. Recent ShinyHunters operations in 2026 include breaching FBI systems, defacing the Clop ransomware gang's data leak site, compromising the Odido telecommunications provider, and claiming breaches of Florida's DMV database and Novocure healthcare systems. The group has also been linked to custom web shell deployment in Windchill data theft attacks, indicating evolving technical capabilities.

Defensive Recommendations

  • Implement robust help desk authentication protocols including callback verification procedures to prevent social engineering attacks where threat actors impersonate internal IT staff (T1598)
  • Deploy multi-factor authentication (MFA) with phishing-resistant methods (FIDO2/WebAuthn) to prevent credential harvesting via fake login pages, and monitor for anomalous authentication attempts (T1078, T1056.003)
  • Establish behavioral analytics and anomalous access monitoring for privileged accounts and internal systems to detect unauthorized access following credential compromise
  • Conduct regular security awareness training focused on vishing and pretexting scenarios, specifically targeting help desk and support personnel who handle authentication requests
  • Monitor for data exfiltration patterns and implement data loss prevention (DLP) controls on sensitive databases and cloud storage to detect large-scale data theft operations (T1530, T1005)

---

# Geopolitical Context

Geopolitical Context

The arrest of a 24-year-old Amsterdam resident in connection with the ShinyHunters hacking group represents a continuation of European law enforcement efforts to disrupt financially motivated cybercrime networks. ShinyHunters has been associated with large-scale data breaches affecting organizations globally, including recent high-profile incidents involving U.S. federal systems and ransomware infrastructure. The suspect, identified by open-source researchers as Pepijn van der Stap (alias "Umbreon"), was previously convicted in 2023 for hacking and extortion offenses targeting Dutch and international companies. His re-arrest during the probationary period suggests either recidivism or ongoing investigative interest in his prior activities. The case illustrates the persistent challenge of deterring repeat offenders in cybercrime ecosystems, particularly when actors operate across jurisdictions. ShinyHunters representatives have denied any association with the suspect, though investigative reporting suggests potential linkages through shared online personas and imagery. The incident also highlights the role of social engineering—authorities released audio of a Dutch-speaking individual conducting vishing attacks against telecom provider Odido, though sources close to the suspect dispute voice identification.

State Actor Alignment

ShinyHunters is assessed to be a financially motivated cybercriminal group with no apparent state sponsorship. The group's activities are consistent with profit-driven data theft and extortion rather than espionage or strategic objectives. Dutch law enforcement cooperation with international partners, including apparent coordination with U.S. authorities following FBI-related breaches, reflects standard mutual legal assistance frameworks within NATO and EU jurisdictions. The Netherlands has demonstrated consistent commitment to prosecuting cybercriminals operating from its territory, regardless of target geography. No evidence suggests state protection or tolerance of the suspect's activities; the arrest during probation indicates active monitoring and enforcement. The case does not appear to involve geopolitical tensions between states, though ShinyHunters' targeting of U.S. federal systems and critical infrastructure may elevate international law enforcement prioritization.

Business Impacty pro region

The arrest reinforces the Netherlands' position as an active participant in transnational cybercrime enforcement, consistent with its role in prior operations against criminal infrastructure and actors. European law enforcement agencies continue to face challenges in attribution and prosecution of cybercriminals who operate pseudonymously across borders, particularly when suspects deny affiliation and use shared or appropriated online identities. The case may have implications for ongoing investigations into ShinyHunters' broader network, particularly if seized electronic devices yield intelligence on co-conspirators or infrastructure in other jurisdictions. For the broader European cybersecurity community, the incident underscores vulnerabilities in telecom and enterprise sectors to social engineering attacks, as evidenced by the Odido breach methodology. The suspect's recidivism despite a substantial prison sentence may inform policy discussions around sentencing guidelines and post-conviction monitoring for cybercrime offenders within EU member states. Globally, the case contributes to a pattern of Western law enforcement targeting financially motivated threat actors, though the effectiveness of such arrests in disrupting decentralized cybercrime groups remains uncertain.

Forecast

If Dutch authorities successfully establish evidentiary links between the suspect and recent ShinyHunters operations, the case may lead to additional arrests or indictments in partner jurisdictions, particularly if international cooperation yields intelligence on co-conspirators. However, if the connection relies primarily on circumstantial evidence such as shared online personas, prosecution may face challenges, especially given the suspect's denial and ShinyHunters' public disavowal. The September 29 court appearance is likely to provide clarity on the specific charges and evidence basis. If the suspect is convicted of violations during his probationary period, he may face reinstatement of the previously suspended sentence in addition to new charges. The broader ShinyHunters group is likely to continue operations regardless of this arrest, as decentralized cybercrime collectives typically demonstrate resilience to individual member interdictions. If the seized devices contain actionable intelligence, follow-on law enforcement activity may emerge within the next 6-12 months. The case may also prompt enhanced scrutiny of recidivist cybercriminals in the Netherlands and other European jurisdictions, potentially influencing probation monitoring practices.