Former Hacker Arrested in Connection with ShinyHunters Group
Dutch Police Detain Ex-Hacker Linked to Crypto Gang
A 24-year-old convicted cybercriminal was arrested in the Netherlands on September 16. Police suspect he helped the crypto hacking collective known as ShinyHunters. The man is identified as Pepijn van der Stap.
Authorities held him for questioning regarding his potential involvement with the group. Reports indicate he is scheduled to appear in the Rotterdam District Court on September 29. Some local news outlets suggest the United States is also involved in the case.
Background on the Suspect
- Van der Stap operated under the online name "Umbreon" over three years ago.
- During that time, he committed data theft and extortion.
- He was previously arrested, convicted, and given a four-year suspended sentence.
- He was released from prison in December 2025.
- After release, he worked at cybersecurity startup Hadrian and volunteered at the Dutch Institute for Vulnerability Disclosure.
- He currently serves as the offensive security lead at Neo Security.
- Van der Stap told Krebsonsecurity that he considers himself a reformed convict.
Timing of Recent FBI Attack
Just six days after van der Stap's arrest, ShinyHunters claimed responsibility for a major hack. The group stated it stole data belonging to 5,000 FBI agents. They also altered the FBI's job page to show an image of the Pokémon character Umbreon.
Krebsonsecurity reports this attack marks a shift in the group's usual methods. The group is now led by a teenager in Amman, Jordan, known as "Rey." Rey reportedly merged ShinyHunters with other groups, Scattered Spider and LAPSUS$, to form a new entity called ScatteredLapsussHunters.
Motives and Connections
Sources close to the investigation told the publication that Rey has an ongoing conflict with van der Stap. These sources suggest that displaying the Umbreon image might be an attempt by Rey to shift blame toward the recently arrested former hacker.
ShinyHunters has previously been linked to a significant breach of the Dutch telecommunications provider Odido in February 2026. That incident resulted in the leak of personal data, including bank account and passport numbers, for six million customers.
Confirmed Facts vs. Unverified Claims
The following details are confirmed: van der Stap's arrest on September 16, his previous conviction and release, his current employment, and the ShinyHunters claim regarding the FBI data theft. The specific role van der Stap played in recent activities remains under investigation.
Claims regarding the merger of hacking groups and the motive behind the Umbreon image are based on reports from sources close to the investigation and should be treated as unconfirmed allegations until proven in court.
Next Steps in Legal Proceedings
Van der Stap is expected to face the Rotterdam District Court on September 29. The outcome of this hearing will determine the next phase of the legal process.
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.