Threat Intelligence

Dutch Police Arrest Suspect Tied to ShinyHunters Hacking Group

The Hacker News · 29 Sept 2026

Key Takeaway This case is a reminder that insider risk can come from trusted security personnel, so businesses should combine strong access controls with monitoring and vetting practices even for staff in security roles.

Dutch police have confirmed the arrest of a 24-year-old man from Amsterdam in connection with an ongoing investigation into ShinyHunters, a hacking group known for large-scale data theft and extortion. The man is due to appear before the Rotterdam District Court in September 2026.

While police have not officially named the suspect, security journalists have identified him as Pepijn van der Stap, who was previously arrested in 2023 for related data theft and extortion offences. At the time, he was reportedly employed at a cybersecurity firm and volunteering with a vulnerability disclosure organisation, a dual life he later admitted caused him significant stress and paranoia about being caught. He is currently listed as an offensive security lead at a Dutch security company.

The arrest comes shortly after ShinyHunters claimed responsibility for breaching a US FBI job applicant website, allegedly stealing large volumes of sensitive data. The group described the hack as a way to draw attention to their activities, though the full details and motives remain under investigation.

ShinyHunters data breach cybercrime arrest

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.