Dutch Authorities Arrest Cybercriminal Over Alleged Links to ShinyHunters

Dutch authorities have arrested Pepijn van der Stap, known online as Umbreon, on suspicion of assisting the hacking collective ShinyHunters. The case brings renewed attention to the group, which claimed responsibility for a breach of the FBI and has been linked to a massive data leak of Odido customers.

• Pepijn van der Stap, previously convicted for data theft and extortion, was arrested in the Netherlands on September 16, according to reports.
• Coverage indicates he is set to appear in a Rotterdam court on September 29; authorities are investigating his possible connections to ShinyHunters.
• The group claimed responsibility for the data theft of FBI agents and has been linked to the leak of information from millions of Odido customers.

🚨 The Netherlands arrests a hacker investigated for alleged links to ShinyHunters.
Pepijn van der Stap, alias Umbreon, was previously convicted for data theft and extortion.
The group claimed an attack on the FBI and was linked to the data leak of about 6... pic.twitter.com/kf1LInbJb3

--- Diario฿itcoin (@DiarioBitcoin) September 28, 2026

The arrest of a convicted hacker reignites suspicions about ShinyHunters' connections and their recent attacks.

• Dutch authorities arrested Pepijn van der Stap, known as Umbreon, while investigating a possible collaboration with the group.
• ShinyHunters claimed responsibility for the theft of information from FBI agents, although that claim does not alone confirm the extent of the breach or who executed it.
• The collective has also been linked to a leak that exposed personal data of millions of Odido customers.

Dutch Authorities Arrest Convicted Hacker Over Alleged Links to ShinyHunters

Dutch authorities arrested Pepijn van der Stap, a convicted hacker now suspected of aiding the ShinyHunters collective, on September 16. The news of the arrest was reported on September 28 by Reuters. The case connects the investigation of a former data thief with a group that has claimed high-profile attacks and reportedly operates under the leadership of a teenager known as Rey.

Coverage of the case indicates that Van der Stap is to appear before the Rotterdam District Court on September 29. It also notes that the United States is involved in the investigation, but does not specify whether it is a joint inquiry, an extradition request, or another procedure. The publicly available information does not detail what specific actions are attributed to him in relation to ShinyHunters nor confirm any direct collaboration.

From Previous Conviction to New Investigation

Van der Stap, known online by the alias Umbreon, was convicted of data theft and extortion. Protos reports that he received a four-year prison sentence. There is insufficient basis to assert that the sentence was suspended or that he was released from prison in December 2025, so those details are not included here.

During his criminal activities, Van der Stap worked at Hadrian, a cybersecurity startup, and also volunteered at the Dutch Institute for Vulnerability Disclosure, a nonprofit organization. Coverage indicates that he currently holds the position of offensive security lead at Neo Security. In an interview with KrebsOnSecurity, he described himself as a reformed convict; the new investigation raises suspicions but does not equate to a new conviction.

According to coverage, Van der Stap was to appear before the Rotterdam District Court on September 29. For now, public information does not specify what charges or procedural decisions may be presented at that hearing. It also does not clarify what type of involvement the mentioned U.S. authorities would have in media reports.

The case unfolds in a context of digital identities that can complicate the attribution of attacks and the separation between provocations and evidence. The alias Umbreon reappeared in an episode related to the FBI, but the cited reports also point to a dispute between Van der Stap and a leader of ShinyHunters. This possibility helps explain why investigators are examining the connection, but it does not alone demonstrate who executed the attacks.

A Claim Against the FBI and Suspicions About Umbreon

On September 22, ShinyHunters claimed to have breached the FBI and stolen data from its agents, according to Reuters. Reports on the case estimated the allegedly stolen information to involve data from 5,000 agents. The group also reportedly manipulated the agency's job page to display an image of Umbreon, the Pokémon character that inspired the alias attributed to the suspect. This reference does not confirm that Van der Stap participated in the incident, and the FBI stated that it was investigating a suspected intrusion.

The claim came six days after the reported arrest of Van der Stap. This temporal proximity does not establish a causal relationship between the arrest and the FBI episode. It also does not allow for determining when the intrusion occurred, who carried it out, or whether the data that the group claimed to have stolen was independently verified.

According to KrebsOnSecurity, the episode against the FBI would deviate from the usual pattern of attacks attributed to ShinyHunters. The publication also notes that the group is reportedly under the leadership of a teenager based in Amman, Jordan, known as Rey. According to those reports, Rey has merged ShinyHunters with the collectives Scattered Spider and LAPSUS$ into a group called ScatteredLapsussHunters. The available information does not provide additional details about its structure or the extent of this union.

Sources close to the investigation told KrebsOnSecurity that Rey maintained a dispute with Van der Stap and suggested that the image of Umbreon on the FBI page may have been an attempt to divert suspicion towards him. This is a hypothesis attributed to individuals familiar with the investigation, not an official conclusion or proof that the leader ordered the maneuver. The use of an alias or a visual reference can confuse investigators and observers, but it does not establish who was behind an intrusion.

ShinyHunters has also been linked to an attack on the Dutch telecommunications provider Odido, reported in February 2026. In that episode, personal data of around six million customers was leaked, including bank account numbers and passports, according to available coverage. The scale of the exposure shows the potential impact of operations attributed to the group, although the cited reports do not specify what proportion of the records was independently verified or detail the consequences for each customer.

The case of Van der Stap combines criminal records with new suspicions whose resolution will depend on the investigation and the judicial process expected in Rotterdam. The claim of the attack on the FBI, the dispute mentioned by sources close to the case, and the precedent of Odido provide context about ShinyHunters, but do not replace specific evidence regarding the detained individual's participation. The hearing scheduled for September 29 will be a forthcoming public milestone, although the available information does not anticipate what charges or decisions may be presented.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.