Pepijn van der Stap, a Dutch convicted cybercriminal and former member of the ShinyHunters hacking collective, was arrested in September 2026 for involvement in data thefts and extortion activities. Van der Stap operated under the hacker handle 'Umbreon' and was linked to selling stolen data on hacking forums. ShinyHunters conducted a significant social engineering attack on Odido, compromising data of over 6.2 million Dutch citizens. After Van der Stap's arrest, ShinyHunters intensified their operations, including a high-profile breach of the FBI's job application portal, exploiting a zero-day PeopleSoft vulnerability (CVE-2026-35273) that Oracle patched promptly. Despite mitigations, ShinyHunters used URL encoding techniques to bypass web application firewall rules. The group also extorted the Russian ransomware group Cl0p. The FBI confirmed the breach, which exposed sensitive personal and medical information of over 5,000 officials. The investigation remains active, with Dutch police seeking to identify additional members involved in the Odido intrusion.

The arrest of Van der Stap disrupted ShinyHunters' operations but triggered an escalation in attacks, including breaches of high-profile targets such as the FBI and the ransomware group Cl0p. The FBI breach exposed sensitive personal data, including Social Security numbers and medical files of thousands of officials, posing significant privacy and national security risks. The Odido breach compromised personal data of over 6.2 million Dutch citizens, impacting privacy and potentially enabling further fraud or identity theft. The exploitation of a zero-day PeopleSoft vulnerability allowed ShinyHunters to access multiple organizations across various sectors. These incidents demonstrate the group's capability to conduct large-scale data theft and extortion campaigns with severe consequences for victims.

Oracle has issued an official patch for the PeopleSoft vulnerability (CVE-2026-35273) exploited by ShinyHunters, and organizations are advised to apply this update promptly. Mandiant released web application firewall rules to mitigate the threat, but ShinyHunters have demonstrated evasion techniques against these rules, so additional monitoring and layered defenses are recommended. Dutch authorities continue their investigation and have requested public assistance to identify individuals involved in social engineering attacks. Organizations should verify that all patches are applied and remain vigilant against social engineering attempts. No further specific mitigations are indicated by the vendor or authorities at this time.