Who Is ShinyHunters? Following the Evidence Behind the Name

On 29 September, the FBI announced the arrest of an alleged ShinyHunters leader. Dutch police had detained the 24-year-old Amsterdam resident two weeks earlier on suspicion of participating in a criminal organisation. Reporters identified him as Pepijn van der Stap, a security professional previously convicted of hacking and extortion. ShinyHunters denied any connection to him. FBI, Dutch police, RTL.

On 3 October, RTL reported that another figure associated with the name, known as Rey, may have been detained in Jordan. RTL cited three sources who spoke to Reuters and its own indications. Authorities had not confirmed the reported detention.

On 9 October, FBI Director Kash Patel announced another arrest in the investigation into the FBI jobs-portal breach. He did not name the suspect. A federal docket records the 8 October arrest of Edward Dobrovsky on extortion-related allegations. Politico identified him as Canadian cybersecurity executive Edward Dubrovsky, who worked in ransomware negotiations. The complaint is sealed, and the public record does not establish whether his arrest is the one Patel announced or what connection, if any, he had to the FBI breach.

Pepijn’s alleged role remains disputed. So does the shape of the group he is accused of belonging to.

Court cases and breach investigations trace different people and operations using the ShinyHunters name. They don’t establish an unbroken history of its leadership. Sometimes, even the theft and the ransom demand are attributed to different operators.

For a company facing extortion, this is a practical problem: who controls the stolen data, and who else has a copy?

This reconstruction uses public documents, published reporting and technical investigations reviewed through 10 October 2026. No new interviews were conducted for it. The current allegations remain unproven.

From developer accounts to stolen databases

A June 2021 US indictment against three French nationals describes phishing pages that imitated legitimate services. Prosecutors alleged that stolen employee logins opened corporate systems, and that the resulting data were offered on underground markets under the ShinyHunters name. US Department of Justice.

Sébastien Raoult was arrested in Morocco in 2022 and extradited to the United States. In January 2024, he received three years in prison for conspiracy to commit wire fraud and aggravated identity theft. That verdict applies to his conduct in this case. DOJ sentencing announcement.

The forums supplied buyers and an audience. Running one didn’t necessarily mean directing its sellers: BreachForums founder Conor Fitzpatrick received a three-year sentence on resentencing in September 2025 for operating the forum. His case does not establish that he founded or led ShinyHunters. DOJ.

ShinyHunters borrows its name from players searching for rare, differently coloured Pokémon. The name made the sellers recognisable while they remained anonymous. Trouw.

Le Monde reported in May 2026 that French investigators distinguished at least two ShinyHunters phases without a proven connection. Aliases were reused; prosecutors treated ShinyHunters as a collective name. The underlying French files were not independently obtained for this article. Le Monde, 20 May 2026.

In an October interview with RTL, Raoult described ShinyHunters as a name used by changing operators. An anonymous source in the criminal world claimed that Rey and Pepijn had quarrelled over leadership and formed separate groups. That is a source’s account, not an established map of who controlled the operation. The reported detention in Jordan leaves the relationship between the two suspects, and their roles in particular attacks, unresolved.

The dates help orient the investigations. Each entry is a documented case or public finding; the timeline does not assert a continuous leadership team.

Who steals the data, and who gets paid?

Incident responders often have the attack logs before they have a name.

Google tracked Salesforce intrusions as UNC6040 and subsequent extortion as UNC6240. The extortionists called themselves ShinyHunters. Some demands arrived months after the theft, leaving open whether the intruder and negotiator were the same operator. Google Threat Intelligence Group.

Mandiant’s January 2026 report distinguished UNC6661, UNC6671 and UNC6240, allowing for partnerships and impersonation. These provisional groupings describe activity; they are not membership lists. Mandiant.

At the European Commission, CERT-EU traced initial access with high confidence to the Trivy supply-chain compromise, publicly attributed to TeamPCP. A stolen AWS credential was used in the environment; ShinyHunters later published the data. That sequence doesn’t establish who performed each step or shared in the proceeds. CERT-EU.

Allison Nixon’s February 2026 analysis for Unit 221B concerns a Com-associated group using ShinyHunters and related names. She explicitly distinguishes it from pre-2025 users of the name. Her harassment findings therefore cannot be applied wholesale to the earlier French defendants or the Dutch suspect. Unit 221B.

The sources leave the relationships unresolved. A single organisational chart would imply more certainty than they support.

Access through the systems companies already trust

The methods have changed too.

Google documented callers posing as IT support and persuading employees to authorise an attacker-controlled application in Salesforce. Approval gave it access through the platform’s normal functions. Google found no inherent Salesforce vulnerability behind those intrusions. GTIG.

In the adjacent 2024 Snowflake campaign, UNC5537 used stolen customer credentials. Accounts without multi-factor authentication (MFA) and passwords still valid after exposure were vulnerable. Mandiant found no evidence of a breach of Snowflake’s enterprise environment. The report tracks UNC5537 as a distinct cluster; it does not establish every participant as a ShinyHunters member. Mandiant.

The Salesloft Drift incident offered another route. Google tracked the use of stolen integration tokens as UNC6395. Those tokens carried access customers had already granted. GTIG’s Drift investigation.

Cloudflare found 104 of its API tokens in the affected support data and rotated them. It reported no suspicious activity involving those tokens. Revoking the compromised integration alone would have left these other credentials unchanged. Cloudflare.

In September 2026, Mandiant and Google reported renewed exploitation of CVE-2026-35273 in Oracle PeopleSoft by UNC6240/ShinyHunters. The earlier campaign had used the flaw as a zero-day. Social engineering alone could not explain these campaigns. Mandiant and GTIG.

Different routes led to the same kind of target: business platforms holding large amounts of valuable information.

The pressure after the breach

Once the data have been taken, the extortionist needs to convince the victim to pay.

During the Odido extortion, the Volkskrant described media contact and staged data releases that kept pressure on the company. A purported ShinyHunters spokesperson presented the operation to NRC as discreet and reliable. NRC could not fully verify the speaker’s identity or account. De Volkskrant, NRC.

Kim Zetter reported for WIRED that AT&T paid roughly $370,000 for deletion of stolen records. She checked a cryptocurrency transaction and examined a deletion video, but neither established who controlled the wallets or whether other copies remained. WIRED.

In Connor Riley Moucka’s cloud-data extortion case, DOJ described more than $2.5 million in ransom payments and at least one attempt to extort a victim again. Moucka pleaded guilty in August 2026; sentencing was scheduled for 27 October. These findings concern his case. US DOJ.

The people in those records have little way to tell whether payment changed their risk. They generally can’t check who still has a copy.

The Dutch investigation

Pepijn was active in that underground data market years before the current allegations.

RTL traced his RaidForums account through aliases including Rekt, Espeon and Umbreon. Its 2023 investigation described how an RDC complaint and forum data obtained with German assistance led to the suspect. In a recorded 2025 talk, police officer Barend Frans describes recovering older account details after they had been changed. RTL.¹

Follow the Money interviewed colleagues at Hadrian and DIVD and reported contacts among suspects through forums and Telegram. Its March 2023 account describes the earlier network; it does not establish that those people belonged to the ShinyHunters operation investigated in 2026. Follow the Money.

On 3 November 2023, the Amsterdam court sentenced him to four years in prison, one suspended, for offences including hacking, extortion and money laundering. Contemporary reporting identifies him as the defendant in the anonymised judgment. Judgment, RTL.

In Daniël Verlaan’s October 2025 podcast, Pepijn describes returning to IT work during his sentence. Ticketcounter’s Sjoerd Bakker describes the harm to his business and employees. Both accounts predate the current arrest. Episode page.²

Brian Krebs interviewed Pepijn about rebuilding his life in September 2026. After the arrest, Neo Security’s chief executive told Reuters that Pepijn was its offensive security lead and that an external investigation had so far found no evidence that he had attacked the company or its customers. That account comes from the employer. KrebsOnSecurity, Reuters.

“The suspect was not arrested in the investigation into the Odido hack.”

— Dutch police, 29 September 2026, translated from Dutch

Police also report a separate suspicion of attempted solicitation of two murders abroad, outside the ShinyHunters investigation. On 29 September, the Rotterdam court extended pre-trial detention by 90 days. Police statement.

The reviewed sources neither disclose the evidence for his alleged ShinyHunters role nor provide a substantive defence response. His earlier conviction cannot establish his guilt in this case.

What the records can establish

In a Zero Day interview about another Com-related investigation, Allison Nixon distinguishes the leads that identify a person from the evidence that links them to crimes in court. Her explanation is relevant to attribution, but supplies no evidence against Pepijn. Zero Day.

Technical attribution can need correcting too. Microsoft updated its July 2026 OAuth-abuse report after finding that two reported IP addresses belonged to a researcher. Those entries are excluded from the accompanying hunting material. Microsoft Security.

Sometimes the evidence is missing altogether. In an AWS incident, Unit 42 could not establish the precise exfiltration activity because S3 object-level logging was absent. The available logs could not show which objects had left. Unit 42.

The ShinyHunters name has survived changes in personnel and attack methods. Its extortion campaigns share a business model: steal information, then charge the victim to keep it private. Earlier breaches can lend credibility to the next threat, even when the victim cannot identify who is making it.

The Dutch case may establish who controlled part of that business. Pepijn’s alleged role must be proved through his own conduct. The earlier convictions show that individuals can be held accountable, while the continued use of the name makes clear that one prosecution need not end the threat.

Organisations cannot wait for that outcome. They can limit what an account or integration can retrieve and retain logs that show what happened. When credentials are exposed, recovery must extend to the systems they could still unlock.

For the customers and employees in the stolen records, an arrest can remove a suspect from an operation. It cannot recall the stolen data already in circulation.

Sources and reporting notes:

Based on published reporting and primary documents. No original interviews, undisclosed case files or stolen datasets were used. Technical hunts and dated indicators are in a separate companion.

¹ Barend Frans recording, dated 2025 in its metadata: approximately 10:06–18:33 of 61:45. The supplied recording has no verified public URL. Its automated transcript was not checked word for word; only the broad sequence also reported by RTL is used.

² Daniël Verlaan / De Stroom, Ik Weet Je Wachtwoord, S4E1, 8 October 2025. Automated speech recognition informed the short paraphrase; no verbatim quotations are used. Clip timings follow the 42:19 download, including adverts, and need checking against the audio.