-
Dutch police confirmed the arrest of a 24-year-old Amsterdam man in the ShinyHunters investigation.
-
Reports identify the suspect as former hacker Pepijn van der Stap, also known as ‘Umbreon.’
-
Investigators have not publicly confirmed that he participated in any specific ShinyHunters attack.
The authorities in Dutch have confirmed the arrest of a 24-year-old man from Amsterdam in connection with an investigation into ShinyHunters, a well-known hacking group. The suspect was arrested earlier this month but will soon go to court in Rotterdam.
Reports have identified the suspect as Pepijn van der Stap, a former hacker who used the online alias “Umbreon.” His reported links to ShinyHunters remain under investigation, and police have not publicly confirmed that he took part in any specific attack.
Police Confirm the ShinyHunters Arrest
The Dutch national investigations unit confirmed the arrest on September 28. Police said investigators detained the Amsterdam resident as part of their ShinyHunters probe. The suspect is scheduled to appear before the Rotterdam District Court on September 29. Authorities are expected to provide more information during the court process.
Some reporters identified the suspect as Pepijn van der Stap. Dutch police have not publicly named him. Investigators reportedly searched his Amsterdam home and seized electronic devices during the operation.
The reports said sources familiar with the case linked the arrest to a possible connection with ShinyHunters. Nonetheless, the evidence does not confirm the connection just yet. The case is ongoing, so no charges have linked Van der Stap to a specific hacking activity by ShinyHunters.
Suspect Previously Faced Hacking and Extortion Charges
Van der Stap has a previous cybercrime conviction. Dutch authorities arrested him in January 2023 following an investigation linking him to hacking and extortion activities connected to a number of companies.
He pleaded guilty and received a four-year sentence behind bars. One year of that sentence came with a suspension, followed by a three-year probation period, according to the reported case history. During his earlier activity, Van der Stap used the name ‘Umbreon’ on hacking forums. He also used imagery linked to the Pokémon character.
That detail has drawn attention because ShinyHunters recently used the same character in activity linked to an FBI website. The group has also used the imagery while targeting other hacking-related platforms.
Still, the Umbreon connection alone does not prove that Van der Stap belongs to ShinyHunters. Reports also note that the same character appeared in a HackForums defacement in 2020. Van der Stap created his reported Umbreon account the following year.
The conflicting timeline gives investigators another issue to examine. Digital aliases can provide useful leads, but they do not establish the identity or role of a person on their own.
Odido Hack Adds Another Link to the Investigation
The ShinyHunters investigation also connects with a separate Dutch telecom case involving Odido. Dutch police previously released a recording of a Dutch-speaking man suspected of helping attackers access Odido systems. Investigators said the caller pretended to work for the IT department of the company.
According to reports, the individual who called convinced an employee of the helpdesk to provide login credentials and verification codes on a fake website. This then enabled the hackers to gain access to the internal systems.
Law enforcement has not confirmed that Van der Stap was indeed the caller. DataBreaches says that the voice did not sound like Van der Stap, according to conversations with him and those around him. The importance of this identification lies in the fact that the investigators must link the individual to the actions through direct evidence.
Dutch police have also taken action against infrastructure used for dark web activity, as reported in the news that Dutch police shut down a criminal host used for dark web activities not too long ago.
A nickname, voice, or forum identification is not enough to establish culpability for a crime. Meanwhile, ShinyHunters denied any links to Van der Stap, as a representative of the group denied the allegations.
What Happens Next in the Case?
The court appearance of Van der Stap on September 29 represents the next major step in the investigation. The hearing may provide more information about why authorities detained him and whether they plan to keep him in custody.
The case also comes as ShinyHunters continues to attract attention for major cyber incidents. Recent reports have linked the group to attacks involving government and corporate systems.
ShinyHunters seems to have expanded its activities this year, as investigations continue into its alleged data breaches and extortions. Nevertheless, it is still unclear whether Van der Stap has any involvement in these incidents. In this case, the arrest confirms that the police were investigating, but does not mean that Van der Stap is already guilty of any crime.
As a result, further court proceedings and evidence will establish the extent of the link between Van der Stap and ShinyHunters. Until authorities release more findings, claims about the role of Van der Stap in ShinyHunters should remain treated as allegations.
