Dutch Security Researcher Held Amid Investigation Into ShinyHunters Operations
Dutch authorities have arrested Pepijn van der Stap, a previously convicted cybercriminal who later publicly presented himself as a reformed cybersecurity professional, as investigators examine suspected links to the ShinyHunters hacking operation.
Dutch police confirmed the arrest of a 24-year-old man in connection with the investigation without publicly naming him. Van der Stap's employer, Neo Security, subsequently identified him as the person detained.
Sources cited by KrebsOnSecurity said Van der Stap was taken into custody in mid-September and has remained under investigation.
The arrest does not establish that he participated in ShinyHunters' recent attacks, and the allegations remain subject to investigation and judicial proceedings.
From Convicted Hacker to Offensive Security
Van der Stap was convicted in 2023 over earlier data-theft and extortion activity conducted under the online identity “Umbreon.”
Earlier Intrusions Generated Millions, Prosecutors Said
Dutch prosecutors previously linked him to cybercrime activity estimated to have generated between €1.5 million and €2.7 million.
He received a four-year prison sentence, with one year suspended, and was released in December 2025.
Afterward, Van der Stap publicly distanced himself from cybercrime and moved further into legitimate security work.
Employer Finds No Evidence of Internal Compromise
At the time of his latest arrest, Van der Stap was working as offensive security lead at Neo Security.
Neo Security CEO Benjamin Korper told Reuters that an external investigation had so far uncovered no evidence that Van der Stap compromised the company or its customers.
That distinction is important: his arrest concerns the broader ShinyHunters investigation and does not currently establish misconduct against his employer or its clients.
Odido Breach Forms Part of the Investigative Background
Dutch authorities have separately sought information about a native Dutch speaker recorded during a February social-engineering attack against telecommunications provider Odido.
Social Engineering Exposed Millions of Customers
According to KrebsOnSecurity, attackers persuaded an employee to authenticate through a spoofed website before stealing information associated with more than 6.2 million people in the Netherlands.
ShinyHunters reportedly acknowledged that the voice heard in the recording belonged to one of its members.
However, publicly available evidence has not established that Van der Stap was the individual on that recording.
ShinyHunters Escalates After the Arrest
The timing becomes particularly notable because ShinyHunters dramatically increased its activity shortly after Van der Stap was detained.
FBI Personnel Information Allegedly Stolen
The group claimed responsibility for compromising the FBI's employment infrastructure and stealing sensitive personnel information.
Reuters reported that exposed material included intelligence assignments and medical information, while Krebs reported that data associated with more than 5,000 officials was involved.
The FBI confirmed a compromise, while the full scope and attribution continue to be investigated.
Umbreon Imagery Complicates Attribution
The attackers also used imagery referencing Umbreon, Van der Stap's former online identity, during the FBI incident.
Krebs reported that sources familiar with tensions inside the cybercrime ecosystem believe the imagery may have been deliberately used to associate the operation with Van der Stap.
That possibility remains an attribution hypothesis rather than established evidence.
ShinyHunters Is Becoming a More Fluid Cybercrime Brand
The investigation highlights a broader problem confronting cybercrime intelligence teams: group names do not necessarily represent stable organizations.
ShinyHunters has increasingly overlapped with actors associated with Scattered Spider and LAPSUS$, with researchers using the broader ScatteredLapsus$Hunters label to describe parts of this evolving ecosystem.
Personnel, infrastructure, stolen credentials and even established criminal brands can move between operators.
Attribution Requires More Than Handles and Symbols
Van der Stap's case demonstrates why technical attribution cannot rest solely on aliases, imagery or previous criminal history.
A reused nickname or recognizable symbol may indicate continuity—but it can also be deliberately planted by another actor.
Investigators therefore need to correlate infrastructure, authentication records, cryptocurrency flows, malware artifacts, communication data and operational behavior before connecting a real-world individual to a specific intrusion.
The case ultimately illustrates one of cybercrime investigation's hardest problems: criminal identities can be transferred, impersonated or weaponized, making the difference between technical evidence and deliberate misdirection increasingly important.