Dutch police arrest 24-year-old Amsterdam man in ShinyHunters investigation

TLDR

• Dutch police arrested a 24-year-old Amsterdam man, identified by outside researchers as Pepijn van der Stap ("Umbreon"), on 15 September in an investigation into the ShinyHunters hacking group.
• Police confirmed only that the arrest happened; the ShinyHunters connection is based partly on his past "Umbreon" alias, which the group recently used in an FBI breach claim and a defacement of the Clop ransomware gang's leak site.
• The attribution has a wrinkle: the Umbreon imagery appeared in a 2020 HackForums defacement, a year before van der Stap created his "Umbreon" account on BreachForums in 2021.
• ShinyHunters denied any link to the suspect, calling Dutch police's move a bid for publicity; the man previously served a sentence for hacking and blackmailing over a dozen companies after a 2023 arrest, and appeared before the Rotterdam District Court on 29 September.

Dutch police confirmed a 24-year-old man from Amsterdam was arrested this month in an investigation into the ShinyHunters hacking group, stating only: "It is true that this month a 24-year-old man from Amsterdam was arrested in an investigation into the hacker group ShinyHunters."¹ Outside researchers, including KrebsOnSecurity and DataBreaches.Net, identified the suspect as Pepijn van der Stap, who goes by the alias "Umbreon," and reported that a Dutch tactical police unit searched his Amsterdam home on 15 September and seized electronic devices.²

The suspected ShinyHunters connection rests partly on van der Stap's "Umbreon" alias and its Pokemon branding, which the group has recently used in connection with a claimed breach of the FBI's job application site and a defacement of the Clop ransomware gang's leak site.¹ The attribution has a complicating detail: the Umbreon character and imagery appeared in a 2020 defacement of HackForums, a year before van der Stap created his "Umbreon" account on BreachForums in 2021.¹ DataBreaches, which says it has spoken with van der Stap multiple times, reported that a police-released voice recording tied to a separate Odido hack investigation "did not sound like him," a conclusion also reached by a close friend.²

ShinyHunters denied any connection to the suspect, telling both outlets: "That individual has no association with us," and telling The Hacker News the group was "laughing," suggesting Dutch police were seeking publicity over a separate investigation.¹ Van der Stap was previously arrested in January 2023 for hacking and blackmailing more than a dozen companies in the Netherlands and worldwide, pleading guilty to a four-year sentence with one year suspended and a three-year probation period.² He worked at cybersecurity firm Hadrian, volunteered with the Dutch Institute for Vulnerability Disclosure, and is currently listed as offensive security lead at Neo Security, according to his LinkedIn profile.¹ He appeared before the Rotterdam District Court on 29 September, when further details were expected to be released.²

Why it matters: ShinyHunters' flat denial and the shaky alias-based attribution show how hard it is to pin a real identity on a loosely organised extortion brand that recruits and rebrands constantly, and this arrest lands in the same week the group is separately linked to the Oracle PeopleSoft WAF-bypass campaign and a claimed FBI breach, underscoring how much of "ShinyHunters" activity may be attributed by alias and style rather than confirmed membership.