Dutch Police Arrest Convicted Hacker Over Alleged Links to ShinyHunters Extortion Campaigns

Authorities in the Netherlands have arrested a 24-year-old man on suspicion of aiding data thefts and extortions carried out by the prolific hacker group ShinyHunters. According to three sources cited by Krebs on Security, the suspect is Pepijn van der Stap, from Almere and Lelystad. In the days after the arrest, the remaining ShinyHunters members reportedly escalated their activity. They stole highly sensitive data from the FBI and attempted to extort the Russian ransomware group Cl0p.

Van der Stap was convicted in 2023 over a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. He admitted to leading a double life. Under the handle "Umbreon", he extorted victims and posted stolen data on hacking forums such as RaidForums and Breached. Meanwhile, he worked as a software engineer at a cybersecurity startup and volunteered at a nonprofit vulnerability research group. He was sentenced to four years in prison, with one year suspended, and was released in December 2025.

In an interview with Krebs on Security on September 9, 2026, he described himself as a reformed hacker trying to make a positive contribution to society. He is currently employed as offensive security lead at the Dutch company Neo Security, which did not respond to requests for comment. This summary covers only the opening of the original report, and the article's further details are not included here.