Dutch police arrested a 24-year-old Amsterdam man around September 15, 2026 in a ShinyHunters investigation. The FBI called him "one of the alleged leaders." ShinyHunters says he has no association with them.
The 140+ organizations and $70M+ figures are FBI allegations with no public charging document. The suspect's name comes from journalists, not from authorities, and he has not been convicted in this case.
The public technical picture is unchanged: vishing, SSO and MFA theft, then SaaS data theft and extortion. No public document explains how he was traced.
What authorities have said
On September 28–29, Dutch National Police confirmed the arrest and did not name the man. The FBI announced it the same week. Everything in this section comes from official statements, as relayed by several outlets.
- Arrest: around September 15, 2026, in Amsterdam.
- Detention: a Rotterdam court ordered at least 90 more days of pre-trial detention.
- Suspicion: participating in a criminal organization.
- Murder material: police separately said they found laptop material about two murders planned abroad. TechCrunch reports this is a separate investigation from the ShinyHunters case.
- FBI: Director Patel called him one of the "alleged leaders." Cyber Division Assistant Director Leatherman said the FBI would pursue the remaining members.
Leatherman said the suspect and co-conspirators "allegedly breached more than 140 organizations and taken at least $70 million in extortion payments" since last year, often via SSO accounts, third-party vendors and SaaS platforms such as Salesforce and Snowflake.
No affidavit or breakdown has been published, and the figures cover the co-conspirators, not just the arrestee.
What the press has reported
Journalists identified the man as Pepijn van der Stap, alias "Umbreon." Reuters and Bloomberg followed. Police use only "Pepijn van der S." Reports say he was convicted in the Netherlands in 2023 over data theft and extortion, and that he works in security. Outlets differ on his job title and on the spelling of his name.
Treat the identification as press reporting. It has not been confirmed by authorities, and nothing has been proven in court in this case.
ShinyHunters' response
"That individual has no association with us. Frankly, we are laughing."
A criminal group's denial is neither proof nor disproof of a link. The group also disparaged the police and framed the arrest as a bid for attention. Cybernews relays insider claims of an FBI frame-up, which are unverified.
Separately, ShinyHunters reportedly breached the FBI jobs portal on September 21, after the arrest. The FBI treated it as a cyber incident on September 22 and said the system holds sensitive personal data. The FBI has not tied the breach to the arrest.
The technical picture
Google's Threat Intelligence Group (GTIG) described the core technique in January 2026. It is social engineering, not a vendor vulnerability.
Attack chain, end to end
Vishing to SaaS extortion, as described by Google GTIG
- Call the employee The attacker phones staff posing as IT support and claims the company is "updating MFA settings." vishing
- Harvest credentials The victim is sent to a look-alike login page that captures the SSO password and the live MFA code. <company>sso.com
- Register an MFA device The attacker enrolls their own device, so access persists after the victim's session ends. UNC6661
- Steal SaaS data The stolen SSO session is used to pull data from connected SaaS platforms. SSO to SaaS
- Extort under the brand Victims are contacted under the ShinyHunters name. GTIG links this stage to a shared Tox account, branded emails and Limewire-hosted data samples. UNC6240
How was he traced?
No public document answers this. There is no indictment, complaint or affidavit for this arrest, and the press coverage I found does not describe the method.
The nearest public model is the US complaint against another actor in the same ecosystem, "IntelBroker" (Kai West, SDNY). It shows a pattern that is common in these cases:
- An FBI undercover buyer paid $250 in Bitcoin for stolen data, which gave investigators a wallet address.
- Blockchain analysis followed the wallet to an exchange account.
- The exchange accounts were registered in the defendant's real name, with a date of birth, ID and address.
- Email search warrants tied those accounts to a personal address.
- Logins to those accounts came from the same IP addresses used in the attacks.
Nothing shows that this pattern applies to the ShinyHunters arrest. Watch for a US complaint or indictment and for Dutch prosecution statements.
What we don't know
| Question | Status |
|---|---|
| Is he a leader? | The FBI says so. The group and its insiders dispute it. |
| How were the 140+ and $70M figures computed? | Not published. |
| What formal charges follow? | Unknown. Suspicion only so far. |
| Will the US seek extradition? | Unknown. |
| Which IOCs tie him to UNC6661 or UNC6240? | None published. |
Takeaways
- For defenders: the attack chain is unchanged. Alert on new MFA device registrations that follow unusual logins, lock down help-desk password and MFA resets, and prefer phishing-resistant MFA such as FIDO2.
- For readers: a press-named suspect and a "leader" label are not a conviction, and one arrest does not show the brand is finished. ShinyHunters' reported breach of the FBI jobs portal came after the arrest.
