Dutch police arrest convicted hacker Pepijn van der Stap in ShinyHunters probe
This digest was compiled by AI from multiple sources — links to the originals are below.
Dutch authorities arrested 23-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding data thefts and extortions by the hacker group ShinyHunters. The arrest occurred on or around September 16, 2026, and he has been held in custody for questioning since. Following the arrest, remaining ShinyHunters members escalated attacks, stealing sensitive data from the FBI and extorting the Russian ransomware group Cl0p.
Key Facts
- Pepijn van der Stap was previously convicted in 2023 for data thefts and extortions that earned between €1.5 million and €2.7 million.
- Van der Stap was sentenced to four years in prison, with one year suspended, and was released in December 2025.
- At the time of his arrest, van der Stap was employed as offensive security lead at the Dutch company Neo Security.
- Following the arrest, ShinyHunters members stole sensitive data from the FBI and extorted the Russian ransomware group Cl0p.
Arrest and Custody
Dutch authorities arrested Pepijn van der Stap on or around September 16, 2026. He has been held in custody for questioning since the arrest. A colleague personally witnessed Dutch authorities carting items out of van der Stap's residence.
Criminal History
Van der Stap was convicted in 2023 for a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. He admitted to using the hacker handle 'Umbreon' to extort victims and post their data on RaidForums and Breached. He was sentenced to four years in prison, with one year suspended, and was released in December 2025.
ShinyHunters Escalation
In the days immediately following van der Stap's arrest, remaining ShinyHunters members dramatically escalated their attacks. They stole highly sensitive data from the FBI. They also extorted the Russian ransomware group Cl0p.
9 sources
Time · lag behind first