[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbxCj6iKDOAmRJbwr9BYxyuM49mOq6W_o5yVdyOk7esM":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":70},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f6579ecc-1dd4-45cc-8224-56235aa538f4","Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation","dutch-police-arrest-convicted-hacker-in-shinyhunters-investigation-befd26","Pepijn van der Stap was convicted in 2023 for hacking multiple organizations, stealing their data, and extorting them. The post Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation appeared first on SecurityWeek.","Dutch police have arrested Pepijn van der Stap, a 24-year-old man suspected of being associated with the ShinyHunters extortion group. Van der Stap was previously convicted in 2023 for data theft and extortion and was on supervised release. He is believed to be linked to the ShinyHunters hack of the FBI jobs site, potentially using an exploit for CVE-2026-35273. The arrest comes amid ongoing investigations into ShinyHunters' activities, including a social engineering attack targeting Odido.","Dutch police arrest suspected ShinyHunters member, Pepijn van der Stap, linked to FBI hack.","https:\u002F\u002Fwww.securityweek.com\u002Fdutch-police-arrest-convicted-hacker-in-shinyhunters-investigation\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002Fhacker-arrested.jpeg","2026-09-29T11:01:55+00:00","2026-09-29T12:00:31.809226+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Umbreon",{"name":23,"type":19},"Ray",{"name":25,"type":19},"ScatteredLapsussHunters",{"name":27,"type":28},"Oracle PeopleSoft","product",{"name":30,"type":31},"FBI","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-35273","Oracle PeopleSoft vulnerability exploited by ShinyHunters.",[30,27],{"controls":62,"vendors":63},[],[64],{"slug":65,"name":66,"logo_path":67,"roles":68},"oracle","Oracle","\u002Fvendor-logos\u002Foracle.png",[69],"affected",{"slug":71,"title":72,"body":73,"framework_refs":74,"framework_notes":86},"shinyhunters-suspect-arrested-recidivist-hacker-exploits-unpatched-systems","ShinyHunters Suspect Arrested: Recidivist Hacker Exploits Unpatched Systems","The arrest of Pepijn van der Stap highlights a critical failure in vulnerability management, as the ShinyHunters group allegedly exploited CVE-2026-35273 to compromise a high-profile target such as the FBI jobs site. A previously convicted cybercriminal returning to illicit activity while on supervised release underscores the need for stricter access monitoring and recidivism-aware threat intelligence. The additional social engineering attack on Odido demonstrates that technical exploits are often paired with human manipulation tactics, compounding the risk. Organizations that delay patching internet-facing systems and fail to train staff against social engineering remain easy targets for sophisticated extortion groups. This case matters because it shows that known threat actors can quickly pivot to new victims when systemic security gaps — both technical and human — go unaddressed.",[75,76,77,78,79,80,81,82,83,84,85],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SI-2 – Flaw Remediation","NIST AC-2 – Account Management","NIST AT-2 – Literacy Training and Awareness","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ITIL – Problem Management (root cause analysis for recurring vulnerabilities)",{}]