Dutch Police Confirm Arrest in ShinyHunters Investigation

Dutch police confirmed the arrest of a 24-year-old man from Amsterdam in an investigation into the ShinyHunters hacking group. Police said he was arrested earlier this month and is due to appear before the Rotterdam District Court on Tuesday, September 29, when authorities will release further information.

KrebsOnSecurity and DataBreaches identified the suspect as Pepijn van der Stap, who previously used the online alias “Umbreon.” DataBreaches reported that he was arrested on September 15, when a Dutch tactical police unit searched his Amsterdam home and seized electronic devices. KrebsOnSecurity reported that sources familiar with the investigation said authorities were examining a possible link between him and ShinyHunters.

The shared “Umbreon” identity is not conclusive evidence of a link: the character appeared in a 2020 defacement of HackForums, before van der Stap created an “Umbreon” account in 2021. A ShinyHunters representative told BleepingComputer that van der Stap had no association with the group.

Van der Stap was arrested in January 2023 and charged with hacking and blackmailing more than a dozen companies. He later pleaded guilty and received a four-year prison sentence, with one year suspended, followed by three years of probation. The source reports that Dutch police have separately released a recording of a man suspected in the Odido hack; DataBreaches and a friend of van der Stap reportedly said the voice did not sound like him.