Dutch authorities arrest convicted hacker over suspected ShinyHunters links

Dutch authorities arrested Pepijn van der Stap on September 16 over suspected ties to the hacking collective ShinyHunters, according to reporting cited by Protos. KrebsOnSecurity said the 24-year-old was detained for questioning in the Netherlands and is expected to appear in Rotterdam District Court on September 29. Local media reports also said US authorities are involved in the case. Van der Stap previously operated under the alias “Umbreon” and, more than three years ago, carried out multiple data theft and extortion attacks. He was later arrested, convicted, and given a four-year suspended sentence before being released in December 2025. During that period, he worked at cybersecurity startup Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure. He is now the offensive security lead at Neo Security and had described himself to KrebsOnSecurity as reformed. Six days after his arrest, ShinyHunters claimed it had stolen data belonging to 5,000 FBI agents and altered the FBI job page to show an image of the Pokémon Umbreon. KrebsOnSecurity said sources close to the investigation claimed the group’s leader, a teenager in Amman, Jordan, known as “Rey,” had an “ongoing beef” with van der Stap, and that the Umbreon reference may have been intended to shift blame toward him.