Dutch Hacker Linked to ShinyHunters Arrested Amid Cybercrime Probe
Former cybersecurity worker faces charges in international hacking investigation.
1Suspect's dual identity
Pepijn van der Stap, arrested in Amsterdam, led a double life as a cybersecurity professional by day and hacker 'Umbreon' by night. While working at Hadrian and volunteering at DIVD, he allegedly extorted victims through RaidForums and Breached. His 2023 conviction involved €1.5-2.7 million in data thefts. The current arrest connects him to ShinyHunters through his Pokémon-themed online persona, first used on BreachForums in 2021.
2ShinyHunters' evolution
The cybercrime group has undergone significant changes since its takeover by 'Rey', a teenager from Jordan. Under new leadership, ShinyHunters merged with Scattered Spider and LAPSUS$ to form SLSH. This shift marked a departure from their previous operations, with high-profile attacks including the FBIjobs.gov breach and an extortion attempt against Russian ransomware group Cl0p. Mandiant estimates the group could collect $100 million in extortion payments in 2026 alone.
3Odido data breach
Dutch authorities were already investigating ShinyHunters for breaching Odido, the Netherlands' largest mobile carrier. The attack exposed data of 6.2 million people through a social engineering scheme. While ShinyHunters claimed responsibility, voice analysis suggests van der Stap wasn't directly involved. The group offered legal support to the implicated member, demonstrating their organized structure despite recent leadership changes.
4Legal history resurfaces
Van der Stap's 2023 conviction resulted in a four-year sentence (with one suspended) for hacking and blackmailing companies. Released in December 2025, he worked at Neo Security while facing civil lawsuits from victims. His September 9 interview with KrebsOnSecurity portrayed him as reformed, but police raided his home six days later. The arrest raises questions about his continued involvement in cybercrime during his probation period.
5Possible framing evidence
Investigators found identical Pokémon ASCII art in both van der Stap's 2021 posts and ShinyHunters' 2026 FBI breach. Sources suggest this could be Rey's attempt to frame van der Stap during their power struggle over the group's direction. The timing coincides with ShinyHunters' shift toward riskier operations, including attacks on high-profile targets that differ from their previous modus operandi.
6DIVD security incident
The Dutch Institute for Vulnerability Disclosure, where van der Stap volunteered, recently disclosed an AI-related security breach. While officially unrelated to ShinyHunters, the timing alongside van der Stap's arrest raises questions. DIVD confirmed no former volunteer involvement, but the parallel investigations into both incidents suggest potential undisclosed connections in the Dutch cybersecurity community.
7International implications
The case highlights transnational cybercrime challenges, with suspects operating across the Netherlands, Jordan, and Russia. ShinyHunters' merger with other groups demonstrates how cybercriminal networks consolidate capabilities. Dutch authorities face complexity in prosecuting given the international scope, digital evidence challenges, and the group's evolving structure under new leadership with different operational tactics.
8Cybersecurity industry impact
Van der Stap's case exposes vulnerabilities in cybersecurity hiring practices, where skilled professionals may exploit insider knowledge. His ability to work at Hadrian and Neo Security post-conviction raises questions about industry vetting. The incident may prompt stricter background checks and monitoring in security firms, particularly for employees with hacking histories or access to sensitive systems.