Dutch law enforcement officials have apprehended a 24-year-old resident of Amsterdam in connection with the notorious ShinyHunters hacking group, known for high-profile data breaches. The arrest was made public by the Politie Landelijke Opsporing en Interventies via a social media post on Monday, confirming the individual’s involvement in the ongoing investigation.
Details of the Arrest
The suspect, identified by independent sources as Pepijn van der Stap, is scheduled to make a court appearance at the Rotterdam District Court on September 29, 2026. Van der Stap, who has a history of involvement in cybercrime, was previously detained in 2023 for data theft activities. His background includes working at Hadrian, a cybersecurity firm, and volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD).
In a previous interview, van der Stap admitted to facing paranoia due to his dual roles in legal and illegal activities. Despite focusing on legitimate work, he expressed constant fear of being discovered.
ShinyHunters and the FBI Breach
The arrest coincides with ShinyHunters’ recent claim of hacking into the FBI’s job application portal, apply.fbijobs.gov, resulting in the theft of large volumes of sensitive information. The group, however, insists that this breach was not aimed at extortion or financial gain but rather as a public relations strategy to highlight their capabilities and objectives.
A ShinyHunters spokesperson clarified that the attack was intended to draw attention to their cause, denying any plans to sell or misuse the stolen data. The group emphasized that their actions were not motivated by financial incentives.
Technical Aspects of the Breach
Initially believed to have exploited a zero-day vulnerability in Oracle PeopleSoft, it is now suggested that ShinyHunters used a URL-encoding technique to circumvent web application firewall (WAF) protections. This method allowed them to bypass security measures designed to prevent such intrusions.
The investigation into ShinyHunters continues to unfold as authorities seek to understand the full scope of their operations and the potential risks posed by their activities. Meanwhile, cybersecurity experts stress the importance of robust defenses to guard against sophisticated hacking methods.
The outcome of van der Stap’s trial and the ongoing efforts to curtail ShinyHunters’ operations will be closely monitored by the cybersecurity community, as they have far-reaching implications for data security and privacy.
