Dutch police arrest 24-year-old in ShinyHunters hacking investigation

Dutch police confirmed the arrest of a 24-year-old Amsterdam man in an investigation into the ShinyHunters hacking group. The Politie Landelijke Opsporing en Interventies said the man was detained this month and will appear before the Rotterdam District Court on Tuesday, 29 September 2026, when further information will be released.krebsonsecurity.com+1

The arrest matters because ShinyHunters is a prolific hacker group linked to major data thefts and extortions, including breaches at the FBI's job application site and Dutch telecom provider Odido. Police have not publicly identified the suspect or detailed the specific allegations, leaving the connection between the man in custody and the group's attacks unresolved.ijr.com

Police confirm the arrest

The Dutch police national investigations unit announced the arrest on X, stating a 24-year-old man from Amsterdam was detained as part of the ShinyHunters investigation. The force did not name the suspect. Police said the closed hearing at Rotterdam District Court on 29 September 2026 will determine whether he remains in custody.ibtimes.co.uk

KrebsOnSecurity, citing three sources familiar with the matter, identified the suspect as Pepijn van der Stap, a convicted cybercriminal from the Netherlands who previously used the hacker handle "Umbreon." DataBreaches reported that Van der Stap was arrested on 15 September 2026 when a Dutch tactical police unit searched the Amsterdam home he shared with his mother and seized electronic devices.

Van der Stap was previously convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between €1.5 million and €2.7 million. He pleaded guilty to hacking and blackmailing more than a dozen companies and was sentenced to four years in prison, with one year suspended, followed by a three-year probationary period.

Identification remains unconfirmed publicly

The identification of Van der Stap as the arrested suspect has been reported by KrebsOnSecurity rather than publicly made by Dutch police. Dutch police have not publicly linked the suspect to any specific ShinyHunters attack. A ShinyHunters representative said that the individual has no association with the group, saying, "That individual has no association with us. Frankly, we are laughing."

The case overlaps with an investigation into a February 2026 hack of Dutch telecom provider Odido, in which a Dutch-speaking caller posed as an IT employee and directed a worker to a fake login page, obtaining data on more than 6.2 million Dutch people. Police have not publicly said whether the man in custody is the caller whose voice was recorded.

Court hearing set for 29 September

Days after the reported arrest, ShinyHunters claimed responsibility for an intrusion affecting the FBI's job application website, leaving an ASCII-style image featuring Umbreon, the Pokémon character associated with Van der Stap's former alias. Sources close to the investigation said the image may have been intended to associate the FBI incident with Van der Stap, though this remains an account from those sources rather than a police finding.

The suspect's employer, Neo Security, said forensic investigators visited the office and an outside firm found no evidence Van der Stap acted against the company or clients. Benjamin Korper, his boss, said, "Absolutely everybody I talked to is flabbergasted." DataBreaches, which has spoken to Van der Stap, noted the Odido voice recording did not sound like him. The suspect will appear before the Rotterdam District Court on Tuesday, 29 September 2026, in a closed hearing that will determine whether he remains in custody while the investigation proceeds. Police said further information will be released at that hearing.