Dutch authorities have arrested a 24-year-old man from Amsterdam as part of an investigation into the cybercrime group ShinyHunters, police confirmed. The suspect is scheduled to appear before the Rotterdam District Court on September 29 as investigators examine his alleged connection to the hacking network.
Suspect Identified as Former Cybercriminal
Dutch police have not publicly released the suspect’s name. However, cybersecurity reports have identified him as Pepijn van der Stap, who previously used the online alias “Umbreon.”
Van der Stap was convicted in 2023 in a separate case involving hacking, data theft and extortion. He was sentenced to four years in prison, with one year suspended. After serving his sentence, he attempted to establish a career in the legitimate cybersecurity industry.
Before his latest arrest, Van der Stap was working in an offensive security role at Dutch cybersecurity company Neo Security. His employer said investigators had searched the company’s office following his arrest and that an external investigation had found no evidence, so far, that he had targeted the company or its customers.
ShinyHunters Under Growing Scrutiny
The arrest comes as authorities continue investigating a series of major cyberattacks associated with ShinyHunters.
The group has been linked to the February 2026 breach of Dutch telecommunications company Odido, in which data belonging to millions of customers was reportedly stolen. Investigators have also been examining a Dutch-speaking caller who allegedly used social engineering to obtain access to an employee account.
Police have not publicly confirmed that Van der Stap was the person behind that call. ShinyHunters, meanwhile, has claimed the caller was a member of its group.
The hacking group has also attracted international attention following its claimed breach of an FBI job application website. Reports indicated that sensitive information connected to thousands of FBI personnel was among the stolen data, although investigations into the incident remain ongoing.
Rotterdam Court Hearing Expected to Provide More Details
Van der Stap’s arrest could provide investigators with additional information about the structure and activities of ShinyHunters, although the precise allegations against him have not yet been publicly detailed.
Dutch authorities said the suspect would appear before the Rotterdam District Court on September 29. The hearing is expected to address his detention while the investigation continues.
The case highlights the continuing challenge faced by law enforcement agencies investigating international cybercrime networks, where online identities, stolen data and criminal operations can span multiple countries.
