Threat IntelligenceEmerging Threats

Dutch Hacker Arrested in ShinyHunters Investigation

Analyst 207||Source: BleepingComputer
Dutch police officer stands near a young man in a formal, secure environment with a blurred police badge in the background.
"It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters," Politie Landelijke Opsporing en Interventies said Monday.

The Dutch national investigative and intervention police confirmed an arrest connected to an inquiry into the hacking collective ShinyHunters and said the suspect will appear before the Rotterdam District Court on Tuesday, September 29, when authorities plan to release further information. Reporting from KrebsOnSecurity and DataBreaches identified the detained man as Pepijn van der Stap, a Dutch hacker who has operated online under the alias "Umbreon."

Arrest confirmed by Politie Landelijke Opsporing en Interventies

The police statement provided the core fact: a 24-year-old Amsterdam man was detained this month in a probe tied to ShinyHunters. Police said the suspect will be brought before the Rotterdam District Court on September 29, and that additional information will be disclosed at that hearing. The announcement from Politie Landelijke Opsporing en Interventies is the official touchpoint setting the immediate legal timetable for the case.

Identity: Pepijn van der Stap and the "Umbreon" alias

KrebsOnSecurity and DataBreaches named the suspect as Pepijn van der Stap and linked him to the online handle "Umbreon." According to the reporting, van der Stap used the "Umbreon" alias and Pokémon imagery on BreachForums as early as 2021. The overlap in imagery has become a focal point for investigators tracing online identities across different incidents.

Past conviction: January 2023 charges, plea, and sentence

Van der Stap was previously arrested in January 2023 and charged with hacking and blackmailing "more than a dozen companies in the Netherlands and worldwide," the reporting states. He later pleaded guilty and was sentenced to four years in prison, with one year suspended, followed by a three-year probationary period that included additional conditions. Those prior legal proceedings form the background to this month's arrest and are central to understanding why authorities took action.

Recent search, seizure, and possible ties to ShinyHunters

DataBreaches reported that van der Stap was arrested again on September 15, when a Dutch tactical police unit searched the Amsterdam home he shared with his mother and seized electronic devices. KrebsOnSecurity reported that sources familiar with the investigation said authorities were examining a possible connection between van der Stap and ShinyHunters.

The potential link rests partly on the reuse of imagery: the "Umbreon" identity previously employed by van der Stap could link him to ShinyHunters, which "recently used the same Pokémon character in a recent FBI breach and the defacement of the Clop ransomware gang's data leak site," according to the reporting. At the same time, attribution is complicated by historical reuse of the same imagery: the same Umbreon character appeared in a 2020 defacement of the HackForums website, a year before van der Stap created the "Umbreon" account.

When asked about van der Stap's arrest, a ShinyHunters representative told BleepingComputer: "That individual has no association with us. Frankly, we are laughing." That denial sits alongside investigators' public steps and the seizure of devices; both the defense claimed by an alleged affiliated group and law enforcement actions will likely figure into the coming court disclosures.

Odido call recording and voice discrepancy

Dutch police previously released a recording of the voice of a Dutch-speaking man suspected of involvement in the Odido hack. Police said the man called an Odido help desk employee, posed as a member of the company's IT department, and tricked the employee into entering credentials and a verification code into a fake login page, which gave the attackers access to internal systems.

DataBreaches, which says it has spoken to van der Stap on multiple occasions, noted that the voice in the released recording "did not sound like him." A close friend of van der Stap reportedly reached the same conclusion, according to the outlet. That discrepancy in voice identification is one of several pieces of contested evidence referenced in the reporting.

What this means for investigators, victims, and threat-monitoring teams

  • Investigators and prosecutors: the upcoming Rotterdam District Court appearance on September 29 is the next formal opportunity for authorities to publish additional evidence or charges and to explain the basis for the arrest and any alleged links to ShinyHunters.
  • Corporate victims and incident responders: the reporting that prior charges involved "more than a dozen companies in the Netherlands and worldwide" and that attackers used social-engineering calls to obtain credentials underscores why seized devices and authentication logs will be critical to any ongoing investigations.
  • Threat-monitoring and attribution analysts: the reuse of the "Umbreon" imagery across multiple incidents (BreachForums activity in 2021, a 2020 HackForums defacement, and recent ShinyHunters actions) highlights the challenges of relying solely on visual markers for attribution; data from device seizures and court disclosures will be central to clarifying connections.

This account is drawn from the public statements and reporting cited above. The Rotterdam District Court appearance on September 29 is the scheduled point when police said further information will be released; until then, the situation remains a developing story.

Source: BleepingComputer — Dutch police confirm arrest in ShinyHunters hacking investigation

CybercrimeData BreachesEmerging ThreatsKrebsonsecurityNetherlandsShinyhuntersHacker ArrestPolitie Landelijke Opsporing En InterventiesUmbreon
Related Intelligence

Continue Reading

IT staff gather around console, surveying disrupted server room.

Ransomware Attack Disrupts Keio's Business Systems

Keio's business operations were disrupted after a ransomware attack was detected on its servers in the early hours of September 26, prompting swift action to shut down its network and prevent further damage. The company is now working closely with the police and external experts to investigate the incident and assess its impact.

Analyst 207
Technicians work in a network operations center with industrial equipment and computers in the foreground.

Microsoft Exposes NeedyMantis Malware Used in Long-Term Network Breaches

Microsoft uncovered a sneaky malware called NeedyMantis that's used to secretly maintain long-term access to compromised networks. This lightweight but persistent threat is designed to fly under the radar, allowing attackers to keep a grip on networks for an extended period.

Analyst 207
Concerned employees work at laptops in a brightly-lit car-sharing facility with parked cars and natural daylight.

Times Car Breach Exposes 6.6 Million User Accounts

A massive data breach at Times Car has compromised the personal info of 6.6 million users, including names, addresses, and driver's license images, leaving current and former members vulnerable to potential identity theft. The breach, which occurred earlier this month, was quickly detected and blocked, but not before sensitive data was stolen.

Analyst 207
Modern smartphone on a clean surface with a blurred background and a hint of a document nearby.

Apple Fixes CoreGraphics Flaw Targeted in Sophisticated Attacks

Apple patched a critical CoreGraphics flaw that could let hackers execute arbitrary code on your device, and warned that highly targeted attacks may have already exploited this vulnerability. The fix, which improves bounds checking, is now available for affected systems.

Analyst 207