Dutch authorities have arrested a 23-year-old convicted cybercriminal on suspicion of aiding the prolific hacking group ShinyHunters. According to KrebsOnSecurity, sources identify the suspect as Pepijn van der Stap, a software engineer from Almere and Lelystad who was previously convicted in 2023 for data theft and extortion. Van der Stap had presented himself as reformed, working as offensive security lead at Neo Security and volunteering with the Dutch Institute for Vulnerability Disclosure.
Days after van der Stap’s reported detention on or around September 16, ShinyHunters escalated sharply, claiming a breach of the FBI’s job application site that exposed personal and medical data of over 5,000 officials, and extorting the Russian ransomware group Cl0p. The group also taunted Dutch police, saying the arrested member has full support and that authorities are “a big joke.”
It remains unclear whether Dutch police have linked van der Stap to a February 2026 social-engineering attack on telecom provider Odido that exposed data on 6.2 million Dutch people. ShinyHunters confirmed the voice in that call is a member, but did not name them. Van der Stap’s lawyer and employer did not respond to requests for comment, and he has not communicated publicly since the arrest.