Full Breakdown
Arrest of Former Hacker Pepijn van der Stap Tied to ShinyHunters Probe and Murder Allegations
By Drooid · · How we work
Core Event: Arrest and Murder Investigation
Dutch authorities detained a 24-year-old man from Amsterdam in connection with the international cyber-crime collective ShinyHunters. The suspect, identified by his former employer Neo Security as Pepijn van der Stap, was taken during a police raid on September 15, 2026. He remains in custody and is scheduled to appear before the Rotterdam District Court on September 29, 2026.
Background & Context
ShinyHunters is linked to more than 140 data-theft and extortion incidents worldwide, including breaches of Pornhub, Ticketmaster, AT&T and Dutch telecom provider Odido, which exposed data on over 6.2 million customers. In late September the group claimed responsibility for a breach of the FBI’s job-application portal, alleging theft of 2–3 TB of personnel data covering roughly 38 000 agents and applicants. The FBI confirmed a breach but has not verified the full scope.
Van der Stap previously served a four-year prison sentence (one year suspended) for data theft and extortion in 2023, earning an estimated €1.5-2.7 million from victims. After release in December 2025 he worked as offensive security lead at Neo Security and volunteered with the Dutch Institute for Vulnerability Disclosure.
Timeline
- September 15, 2026 – Police raid on Neo Security offices; van der Stap arrested (BBC, Reuters, TechCrunch).
- September 21, 2026 – ShinyHunters claims breach of FBI servers.
- September 29, 2026 – Scheduled court appearance in Rotterdam.
Data & Statistics
- 140+ organizations breached by ShinyHunters (FBI).
- $70 million in extortion payments alleged (FBI).
- 2–3 TB of FBI personnel data claimed stolen.
- 6.2 million Dutch citizens affected by the Odido intrusion.
Official Statements & Responses
Neo Security CEO Benjamin Korper expressed shock, noting that van der Stap had been “carefully vetted” before hiring and that no evidence has yet linked him to attacks on Neo Security or its clients.
ShinyHunters denied any association with van der Stap and called the Dutch police action a publicity stunt.
Conflicting Reports & Gaps
- Arrest date: Most outlets cite September 15; two sources suggest September 16.
- Age: Early reports listed the suspect as 23; later corrections confirm he is 24.
- Identity disclosure: Dutch police have not officially named the suspect, though Neo Security and multiple media outlets identify him as Pepijn van der Stap.
- Murder plot outcome: Authorities have not confirmed whether the alleged murders were carried out.
Verbatim Quote
- “Arresting cybercrime suspects is a key intervention in our broad-based fight against this type of crime,” — Stan Duijf, Dutch police cybercrime official
What’s Next
Van der Stap will appear before the Rotterdam District Court on September 29, 2026, where a judge is expected to order continued detention for at least 90 days. Investigators will examine his laptop for evidence of alleged murder contracts and any links to the Odido or FBI breaches. The FBI indicated that additional leads are being pursued in coordination with Dutch law-enforcement partners.