Convicted cybercriminal arrested in connection with ShinyHunters group

A 24-year-old convicted cybercriminal was arrested in the Netherlands on September 16 on suspicion of aiding crypto hacking collective ShinyHunters.

Krebsonsecurity reports that Pepijn van der Stap was detained by Dutch authorities for questioning in relation to ShinyHunters. 

Police claim he’ll appear in the Rotterdam District Court on September 29, while local news reports the United States is also involved in his case.

Over three years ago, van der Stap carried out multiple acts of data theft and extortion under the moniker “Umbreon.”

Read more: Crypto hacking group ShinyHunters says it stole data of 5,000 FBI agents

Van der Stap was eventually arrested, convicted, and handed a four-year suspended sentence. He was released in December 2025.  

While carrying out his criminal activities, he worked at cybersecurity startup Hadrian and volunteered at the nonprofit Dutch Institute for Vulnerability Disclosure.

He’s currently the offensive security lead at Neo Security, and described himself to Krebsonsecurity as a reformed convict. 

ShinyHunters attacked FBI days after van der Stap’s arrest

Just six days after van der Stap’s arrest, ShinyHunters claimed responsibility for hacking and stealing the data of 5,000 FBI agents. 

This attack also manipulated the FBI’s job page to display a picture of the Pokémon Umbreon.

Krebsonsecurity reports that the attack represented a shift in ShinyHunters’ usual attacks while the group is under the leadership of a teenager based in Amman, Jordan, who goes by the nickname “Rey.”

Rey reportedly merged the group with fellow hacking groups Scattered Spider and LAPSUS$ to become ScatteredLapsussHunters.

Read more: Crypto hackers target Hinge and Match Group in data leak

Sources close to the ShinyHunters investigation told the publication that Rey had “ongoing beef” with van der Stap, and that Umbreon’s inclusion was possibly an attempt by Rey to shift blame towards van der Stap.

ShinyHunters has also been linked to the hacking of the Netherlands telecommunications provider Odido last February. 

Personal data, including bank account and passport numbers, of six million Odido customers were leaked.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.