Sources name convicted extortionist Umbreon as the suspect in Dutch ShinyHunters arrest

The public link between van der Stap and ShinyHunters is one alias. He used the Umbreon handle and Pokemon imagery on BreachForums as early as 2021 ^[11]. The defacement ShinyHunters left on FBIjobs.gov carried ASCII art of the same character ^[12]. That image appears identical to one in a 2020 HackForums defacement attributed to ShinyHunters, a year before he created his Umbreon account ^[12]. Sources familiar with the investigation told KrebsOnSecurity the imagery may have been a deliberate attempt by the group's current leader, a teenager from Amman, Jordan known as Rey, to pin the hack on van der Stap ^[13]. The two reportedly had ongoing bad blood over control of the ShinyHunters brand and data ^[13].

Everything that identifies the suspect comes from Krebs's sources ^[3]. Police have confirmed his age, his city and the investigation he was arrested in ^[1]. They were already investigating a separate ShinyHunters breach of Odido, the Netherlands' largest mobile carrier ^[18].

Krebs's sources describe a group that was taken over. Rey operates inside ScatteredLapsussHunters, a crew described as an amalgamation of Scattered Spider, LAPSUS$ and ShinyHunters ^[15]. "Multiple sources close to the ShinyHunters investigation said the group's recent risky attacks against the FBI and one of Russia's most venerated ransomware groups amounted to a major pivot away from the more measured tenor of the hacking gang's operations," KrebsOnSecurity wrote ^[14]. Security Affairs places the FBI breach, the extortion attempt against Cl0p and the broader escalation after van der Stap's arrest ^[16]. If those accounts hold, the person directing the current attacks is Rey ^[13].

Van der Stap's day jobs were in security ^[6]. KrebsOnSecurity reported that at his trial in late 2023, van der Stap admitted to leading a double life, secretly using the hacker handle Umbreon to extort victims and post their data on English-language hacking communities such as the now-defunct RaidForums and Breached ^[5]. Prosecutors said those thefts and extortions earned between 1.5 million and 2.7 million euros ^[4]. In the same period he was a software engineer at Hadrian, an Amsterdam cybersecurity startup, and a volunteer at the Dutch Institute for Vulnerability Disclosure ^[6]. The reporting describes these jobs and the later Neo Security role, but it does not allege he used employer access in any attack ^[6][8].

On September 9 he told Krebs he was a reformed hacker trying to make amends, then stopped responding ^[9]. Six days later, police searched the Amsterdam home he shared with his mother and seized several electronic devices ^[10][2]. The search came about nine months after his release, inside the three-year probation that followed his sentence ^[1].