Arresting One Hacker Does Not Kill a Collective
dutch police arrested a 24-year-old this month, and many people wanted to say this was a member of shinyhunters. it actually turns into something slightly more than that. this is a solid case study in how hard attribution gets when identity is merely a costume anyone can wear and a threat actor is a hazy fog of nothingness.
the suspect is pepijn van der stap, known online as umbreon. this is no random name. pepijn was convicted in 2023 for data theft and extortion against more than a dozen companies. he served part of a four-year sentence, and was released in december 2025.
after his release in december 2025, pepijn returned to cyber security and was working as an offensive security lead at neo security, while giving interviews about turning his life around. one of those interviews ran earlier this month on september 9. he was arrested roughly a week later. yesterday, september 29, a rotterdam court ordered him held for 90 days.
so far this probably reads like some reformed-hacker-relapses story. the problem is the evidence, and what it says about attribution in 2026.
then came the breach of the fbi's jobs portal, after pepijn was already in custody. the attackers left behind ascii art of the umbreon handle. that may sound damning to some. but plenty of threat actor groups plant false flags to throw off forensics. it is also important to understand how shinyhunters actually works.
this is not your mother's adversary groups with an hr team and a roster of members. shinyhunters is a loose collective, and reporting now describes an amalgamation with scattered spider and lapsus$ operating as scatteredlapsusshunters. multiple sources cited by krebs say a teenager in amman who goes by rey has taken a leading role. multiple sources say rey planted the umbreon imagery specifically to frame van der stap, with whom he previously had beef.
the strongest visible link between the suspect and the breach is merely a handle. a handle is exactly the kind of thing a rival can wear to burn you. in a world where your identity is a name you typed, someone else can just as easily type it too.
the other thread of evidence is a voice. during the odido breach in february, exposing data on roughly 6.39 million people, the attacker called a help desk. they posed as internal it, and talked an employee into handing over credentials. standard social engineering still works in 2026, believe it or not.
police have the recording of this call. police have not publicly identified van der stap as the caller. databreaches and a person close to him say the voice does not sound like him at all. and shinyhunters, asked directly, said he has no association with them. frankly they are laughing at this entire escapade.
none of this means he is innocent. a rival framing him and him being guilty are not mutually exclusive. the dutch police are also reportedly investigating him for trying to orchestrate two murders abroad, which is not the kind of allegation you can merely wave off. the point here is not that police got the wrong man. the point is that from the outside, with the evidence made public so far, there is no way to confidently say the perpetrator is pepijn. neither can anyone definitively call this a decapitation strike against shinyhunters.
the defender's problem sits upstream of whether they got the right man. we are used to attribution resting on infrastructure, tooling, and behavior. the public case visible from the outside gives us a nickname in a defacement and a disputed voice on a call.
whatever else police have, they have not made it public. both are easily contested, plantable, or deniable. the adversary is a fluid collective with no membership. handles get shared, reused, and weaponized between rivals. the group can deny you on the record, and laugh while doing it. stack those together and the confidence you can place in "we caught a member" drops big time.
even if they got the right man, look at what it changes. shinyhunters already claims to have merged into a larger entity. leadership already moved on. the collective publicly laughed.
you cannot decapitate an organization with no head, but merely a rotating cast of people who wear each other's names. arresting one suspected operator does not amount to a decapitation strike against something already reshuffling around him. it removes one person from a crowd that was already reshuffling.
the uncomfortable version is this. the arrest is a real result for dutch law enforcement, and the new allegations are serious. but as threat intelligence, it is a warning. attribution is getting easier to fake and harder to prove at exactly the moment the groups we are chasing stopped being groups at all.
a handle used to be a clue to identity. it can also be the very weapon used to manufacture one.
