Who Put Umbreon on the FBI Jobs Site | 2 Minute Drill with Drex DeFord
Apple Podcasts
Questions Answered in This Episode
- Do you know who works for the firm testing your systems, by name?
- When your vendor's people change, does anybody at your place hear about it?
- When an attack comes with a signature, does your team treat that signature as a fact or a clue?
About This Episode
In late September a giant picture of Umbreon, the black Pokemon with the yellow rings, showed up on the page where someone applies to be an FBI agent. Pepijn van der Stap, 24, from the Netherlands, used that name online a few years ago. He stole databases, sold them on hacker forums, and extorted the companies he hit. Drex DeFord puts the take somewhere between 1.5 million and 2.7 million euros. Van der Stap confessed in 2023, received a four-year sentence, and got out in late 2025. He worked as a software engineer at Hadrian, volunteered with a Dutch nonprofit that warns people about security holes, and most recently was the offensive security lead at Neo Security, a firm that breaks in on purpose and reports the holes. On September 9 he told Brian Krebs he was trying to turn his life around. About a week later he stopped answering messages. Dutch police arrested him in an investigation into ShinyHunters. The FBI called him a leader of that gang.
ShinyHunters claimed the FBI website hack. They claimed a PeopleSoft bug got them in, and they claimed data on thousands of agents, applicants, and families, including Social Security numbers. The FBI continues to investigate those claims. Brian Krebs's sources describe an ongoing fight between van der Stap and the group's current leader, a teenager in Amman, Jordan, who goes by Rey, over who controlled the ShinyHunters name and its stolen data. Those sources treat the oversized Umbreon as Rey's way of pinning the FBI hack on the Dutchman. Reuters reported on October 3 that Jordanian authorities detained Rey and that he is now helping the FBI find other members. Dutch police also reported evidence on van der Stap's laptop that he may have been planning a couple of murders. Drex keeps that separate from the ShinyHunters story. ShinyHunters has been hitting healthcare all year. Drex puts Medtronic at about 3.8 million people and AdaptHealth at about 4.1 million patients, and he names McKesson and One Medical. Health-ISAC put out a warning about the group in July. The move he flags is still a phone call: somebody who sounds right asks the help desk for a password reset. The people hired to test that desk have reached some of the most sensitive access a health system hands out. A second chance in this field needs a background check and a short leash. When a name shows up at the scene, painted in big yellow rings, the question is who put the clue there.
Remember, Stay a Little Paranoid.
Transcript
This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.
Who Put Umbreon on the FBI Jobs Site | 2 Minute Drill with Drex DeFord
[00:00:00] Drex: Hey everyone, I'm Drex, and this is the Two Minute Drill. Thanks to Zscaler for sponsoring today's podcast. It's great to see you today. Here's some stuff you might want to know about. There's a Pokemon called Umbreon, and it's a little black fox looking thing, and it has yellow glowing rings on its fur. Kids trade the cards. It's cute. In late September, a giant picture of Umbreon shows up on the FBI's job application website. It's on the page where you would normally go to apply to be an agent. So first thought, you know, a prank? Well, kind of, it may have been a calling card,
[00:00:40] Drex: and to understand who that card was pointing to, you have to meet Pepijn van der Stap. He's 24, he's from the Netherlands, and a few years ago online, he went by Umbreon. He stole databases, and he sold them on hacker forums. He extorted the companies he stole from. He made somewhere between a million and a half and 2.7 million euros doing these crimes. In 2023, he confessed, he was sentenced to four years, and he went away. And then he did the thing we all kind of hope people do. He was released in late 2025, and he went to work for the other side. He went to work for the good guys. He worked as a software engineer at a security company called Hadrian.
[00:01:23] Drex: He volunteered with a Dutch nonprofit that warns people about security holes. And most recently, he was the offensive security lead at a company called Neo Security. That's a company that does penetration testing. They break into your company on purpose so that they can find security holes and tell you about them before the bad guys find them. And on September 9th, in an interview, van der Stap told Brian Krebs he was trying to turn his life around and make a positive contribution to society. But about a week later, he stopped answering messages. Dutch police had arrested him in an investigation into the cybercrime gang, ShinyHunters. The FBI called him a leader of that gang.
[00:02:06] Drex: So the Pokemon now starts to make a little more sense. ShinyHunters claimed they did the FBI website hack. They say they use the PeopleSoft bug to get in, and they claim they have data on thousands of agents and applicants and families, including social security numbers. And the FBI continues to investigate those claims. So the guy who used to call himself Umbreon gets arrested right around the same time Umbreon, the Pokemon character, shows up on the FBI's website. It's an open and shut case, right? Well, Brian Krebs sources say ShinyHunters' current leader, a teenager in Amman, Jordan, who goes by Rey,
[00:02:46] Drex: had an ongoing fight with van der Stap over who controlled the ShinyHunters' name and its stolen data. Those sources think the oversized Umbreon posted to the FBI website might've been Rey's way of pinning the FBI hack on the Dutchman, van der Stap.
[00:03:06] Drex: This week Reuters reported Jordanian authorities detained Rey and that he's now helping the FBI find other members of ShinyHunters. So who did what?
[00:03:17] Drex: Honestly, we don't really know. And to make the story even more weird, the Dutch police say that they also found evidence on van der Stap's laptop indicating he may have been planning a couple of murders. It appears that that plan is probably separate from all this ShinyHunters' mess I've described in the story. Now to bring it home to healthcare, ShinyHunters has been hammering healthcare all year, Medtronic, about 3.8 million people. AdaptHealth, about 4.1 million patients. McKesson, One Medical, the list goes on. Health ISAC put out a warning about them in July. Their favorite move is still a phone call. Somebody calls your help desk, that sounds right,
[00:03:59] Drex: and they ask for a password reset. And the people you hire to test that help desk have shown again and again that sometimes they're able to get some of the most sensitive access you'll ever hand to anyone. So, long, strange story. I think we're happy to give people second chances in this field. Lots of great defenders started on the wrong side. But a second chance also needs a background check and a really short leash, probably for a pretty good while. And when somebody's name shows up at the scene of a crime, maybe painted in big yellow rings, is it worth asking who really put that clue there?
[00:04:42] Drex: So, here's today's questions. Do you know who works for the firm that is testing your systems by name? When your vendors people change, does anybody at your place hear about it? And when an attack comes with a signature, does your team treat that as a fact or a clue?
[00:05:02] Drex: That's it for today's Two Minute Drill. Thanks again to Zscaler for sponsoring today's show. Drop me a note, let me know what you're working on. I'm always happy to hear from you. I'm Drex at 229project.com. Thanks for being here. Stay a little paranoid. I'll see you around campus.
