Authorities in the Netherlands have confirmed that a 24-year-old man from Amsterdam was taken into custody this month as part of an ongoing investigation targeting the ShinyHunters hacking group. The Politie Landelijke Opsporing en Interventies made the announcement on Monday, stating: "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters."
The suspect is scheduled to appear before the Rotterdam District Court on Tuesday, September 29, at which time additional details about the case will be disclosed by police.
Security researchers at KrebsOnSecurity and DataBreaches have identified the detained individual as Pepijn van der Stap, a Dutch hacker who previously operated under the online handle "Umbreon."
Van der Stap has a criminal history related to cybercrime. He was arrested in January 2023 and charged with conducting hacking and extortion operations against numerous organizations across the Netherlands and internationally. He subsequently admitted guilt and received a four-year prison sentence with one year suspended, along with a three-year probationary period subject to additional restrictions.
According to DataBreaches, the latest arrest occurred on September 15 when Dutch tactical police units conducted a search of Van der Stap's residence in Amsterdam, which he shares with his mother. Officers confiscated various electronic devices during the operation.
Sources with knowledge of the investigation told KrebsOnSecurity that authorities are investigating whether Van der Stap has ties to ShinyHunters. The potential connection centers on the "Umbreon" persona, which Van der Stap previously employed and which has also been associated with ShinyHunters in recent operations, including a breach attributed to the FBI and a defacement targeting the Clop ransomware gang's data publication site.
Van der Stap began using the "Umbreon" alias and Pokémon-themed imagery on BreachForums starting in 2021. However, the same Umbreon character had appeared in a 2020 defacement of HackForums, predating Van der Stap's creation of the account by a year.
Dutch law enforcement previously made public an audio recording of a Dutch-speaking individual suspected in the Odido breach. In that incident, the suspect contacted an Odido support desk representative, impersonating an IT department staff member, and persuaded the employee to provide credentials and a verification code through a fraudulent login interface, thereby obtaining unauthorized access to company systems.
DataBreaches, which has communicated with Van der Stap on several occasions, stated that the voice in the released recording does not match his. A person close to Van der Stap reportedly reached the same assessment.
When contacted by BleepingComputer regarding Van der Stap's arrest, a representative of ShinyHunters refuted any connection to the suspect. "That individual has no association with us. Frankly, we are laughing," the threat actor stated.
This story remains in active development.