Full Breakdown
Arrest of Former Dutch Hacker Linked to ShinyHunters Surge
By Drooid · · How we work
Background and Recent Escalation of ShinyHunters
Pepijn van der Stap, a 24-year-old Dutch cybercriminal convicted in 2023 for data theft and extortion, was released in December 2025 and hired as offensive-security lead at Neo Security. He publicly claimed to be reformed. Within weeks of his detention, the ShinyHunters collective intensified its campaign, claiming a breach of the FBI’s job-application portal and a large-scale intrusion of Odido, the Netherlands’ biggest mobile-telecom provider.
Timeline of Key Events
- September 9 2026 – Van der Stap told KrebsOnSecurity he was trying to “turn his life around.”
- September 15 2026 – Dutch forensic investigators visited Neo Security; the same night van der Stap was seized in a police raid.
- September 16 2026 – Authorities placed him in custody on suspicion of aiding ShinyHunters.
- Early September 2026 – ShinyHunters released a defaced image on the FBI jobs site featuring the Pokémon Umbreon, echoing van der Stap’s former alias.
- Mid-September 2026 – ShinyHunters announced theft of data on more than 6.2 million Odido customers and personal details for over 5,000 FBI employees.
- September 29 2026 – Van der Stap is scheduled to appear before the Rotterdam District Court.
Data Breaches and Financial Impact
- The Odido intrusion yielded personal data for more than 6.2 million Dutch citizens.
- The FBI breach exposed Social Security numbers and personal information on over 5,000 officials.
- ShinyHunters’ extortion spree is projected by Mandiant and Google Threat Intelligence to generate nearly $100 million in 2026.
Official Statements and Responses
- Dutch police posted on X that a 24-year-old was arrested in connection with the ShinyHunters inquiry.
- Neo Security’s CEO Benjamin Korper said the raid occurred on September 15 and noted the company had hired an external firm to examine possible misuse of its systems.
- ShinyHunters issued a statement supporting the unnamed member involved in the Odido call, promising “emotional, mental, and financial” backing and a criminal-defense lawyer.
- The FBI confirmed the compromise of personnel data.
- Dutch Institute for Vulnerability Disclosure (DIVD) reported an internal AI-related incident it said appears unrelated to ShinyHunters.
Conflicting Reports and Gaps
- Identity of the Odido caller: Police have not confirmed whether the voice captured in the February 2026 call belongs to van der Stap; ShinyHunters claim the speaker is a group member.
- Scope of FBI data: Reports vary between inclusion of Social Security numbers and focus on job titles and team assignments.
- Motivation behind the Umbreon image: Analysts link the graphic to Rey, a teenage leader of the merged ScatteredLapsussHunters, but intent remains unverified.
Verbatim Quotes
- “I truly believe that people deserve a second chance, but in this case I was not thanked for it,” — Benjamin Korper, Neo Security
What’s Next
- Van der Stap will appear before the Rotterdam District Court on September 29 2026.
- Dutch investigators continue to seek the voice from the February 2026 Odido call and to determine any direct links between van der Stap and the recent ShinyHunters attacks.
- ShinyHunters has indicated no immediate deadline for the FBI to rescind its advisory, suggesting the group may maintain its current operational tempo.