Dutch Police Arrest Convicted Hacker Linked to ShinyHunters Data Theft Group

Authorities in the Netherlands have arrested a 23 year old man on suspicion of aiding data theft and extortion carried out by the prolific hacking group ShinyHunters. The suspect has been identified by sources as Pepijn van der Stap, a previously convicted cybercriminal who once used the alias Umbreon to sell stolen data on forums such as RaidForums and Breached. He was convicted in 2023 over data thefts and extortion schemes prosecutors said netted between 1.5 million and 2.7 million euros, and was released from prison in December 2025.

Van der Stap had previously worked as a software engineer at an Amsterdam based cybersecurity firm and volunteered with a Dutch vulnerability disclosure nonprofit while secretly operating as a hacker. After his release, he took a role as offensive security lead at another Dutch security company. He recently described himself to a journalist as a reformed hacker trying to rebuild his life.

In the days following his arrest, remaining members of ShinyHunters reportedly escalated their activity, stealing sensitive data from the FBI and attempting to extort the ransomware group Cl0p. This suggests the group continues to operate despite law enforcement pressure on individual members.