protos.com
1 h
A 24-year-old convicted cybercriminal was arrested in the Netherlands on September 16 on suspicion of aiding crypto hacking collective ShinyHunters.
Krebsonsecurity reports that Pepijn van der Stap was detained by Dutch authorities for questioning in relation to ShinyHunters.
Police claim he’ll appear in the Rotterdam District Court on September 29, while local news reports the United States is also involved in his case.
Over three years ago, van der Stap carried out multiple acts of data theft and extortion under the moniker “Umbreon.”
Dutch police arrested 23-year-old Pepijn van der Stap, known online as “Umbreon,” over suspected links to ShinyHunters activity.
— Dark Web Informer (@DarkWebInformer) September 28, 2026
The previously convicted hacker had publicly described himself as reformed after leaving prison in 2025. Authorities are investigating his possible… pic.twitter.com/ig6EhKZTtx
Van der Stap was eventually arrested, convicted, and handed a four-year suspended sentence. He was released in December 2025.
While carrying out his criminal activities, he worked at cybersecurity startup Hadrian and volunteered at the nonprofit Dutch Institute for Vulnerability Disclosure.
He’s currently the offensive security lead at Neo Security, and described himself to Krebsonsecurity as a reformed convict.
Just six days after van der Stap’s arrest, ShinyHunters claimed responsibility for hacking and stealing the data of 5,000 FBI agents.
This attack also manipulated the FBI’s job page to display a picture of the Pokémon Umbreon.
Krebsonsecurity reports that the attack represented a shift in ShinyHunters’ usual attacks while the group is under the leadership of a teenager based in Amman, Jordan, who goes by the nickname “Rey.”
Rey reportedly merged the group with fellow hacking groups Scattered Spider and LAPSUS$ to become ScatteredLapsussHunters.
French crypto tax firm targeted in ShinyHunters extortion attempt
Sources close to the ShinyHunters investigation told the publication that Rey had “ongoing beef” with van der Stap, and that Umbreon’s inclusion was possibly an attempt by Rey to shift blame towards van der Stap.
ShinyHunters has also been linked to the hacking of the Netherlands telecommunications provider Odido last February.
Personal data, including bank account and passport numbers, of six million Odido customers were leaked.
