Dutch police arrest security professional in ShinyHunters investigation

Dutch police have apprehended a 24-year-old former hacker, Pepijn van der Stap, on suspicion of involvement in data thefts and ransom extortions carried out by the notorious hacker collective ShinyHunters. Following van der Stap's arrest, the remaining members of ShinyHunters intensified their attacks, resulting in the theft of sensitive data from the FBI and extortion attempts against the Russian ransomware group Cl0p.

Van der Stap, who hails from Almere and Lelystad, Netherlands, was previously convicted in 2023 for a series of data thefts and extortions that netted him between 1.5 million and 2.7 million euros. During his 2023 trial, van der Stap admitted to his criminal activities under the pseudonym Umbreon, asserting that he engaged in these actions both online and offline.

By day, he appeared to be a software engineer at the Amsterdam-based cybersecurity startup Hadrian, and a volunteer at the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research organization.

Despite his apparent transformation into a reformed hacker, van der Stap confessed to his criminal actions during his trial and was given a four-year prison sentence, with one year suspended. He had openly claimed to be trying to re-invent himself and contribute positively to society, working in offensive security and attempting to make amends to his former victims.