Officers in the Dutch capital have taken a 24-year-old suspect into custody. He was picked up this month as part of a ShinyHunters investigation, national police said.
The Politie Landelijke Opsporing en Interventies said the man would appear before the Rotterdam District Court on September 29. Independent reporting by Brian Krebs and DataBreaches.Net named him as Pepijn van der Stap, a Dutch hacker once known online as Umbreon.
His history is unusual. Van der Stap was convicted in 2023 over a string of data thefts and extortions that prosecutors said earned between EUR 1.5M and EUR 2.7M. He was sentenced to four years, released in December 2025, and later took a job as offensive security lead at the Dutch firm Neo Security.
Krebs spoke with him on September 9, when he described himself as a reformed hacker trying to make amends. He stopped replying soon after. On September 15, police searched the Amsterdam home he shared with his mother and seized several devices.
The arrest lands as ShinyHunters boasts of stealing terabytes of data from apply.fbijobs.gov. A representative told reporters the intrusion was a marketing campaign meant to protect the group’s business and fight what it called disinformation.
