GoKawiilDutch police arrest reformed hacker Pepijn van der Stap in ShinyHunters probe
Dutch authorities this month arrested Pepijn van der Stap, 23, a previously convicted cybercriminal from Almere and Lelystad, on suspicion of assisting ShinyHunters with data thefts and extortion schemes. Van der Stap was convicted in 2023 for hacks under the alias 'Umbreon' that prosecutors said netted between €1.5 million and €2.7 million, and he served part of a four-year sentence before his release in December 2025. He had since presented himself publicly as reformed, working in offensive security at the Dutch firm Neo Security.
GoKawiil's interpretation of the reporting above, not reported fact.
The arrest highlights how individuals convicted of cybercrime sometimes move into legitimate security roles, raising questions about vetting and recidivism in the industry. The timing is notable because, according to the report, remaining ShinyHunters members escalated attacks—including against the FBI and ransomware group Cl0p—in the days right after van der Stap's arrest, which could suggest the group adapting quickly to the loss of a member. This case may prompt renewed scrutiny of how cybersecurity firms hire people with criminal hacking histories.
- Pepijn van der Stap, 23, was arrested in the Netherlands over alleged ties to ShinyHunters.
- He was previously convicted in 2023 for hacks that earned €1.5–2.7 million and had claimed to be reformed.
- ShinyHunters escalated attacks on the FBI and ransomware group Cl0p shortly after his arrest.
Source: krebsonsecurity.com, 2026-09-28
Published there as: “Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.