A Dutch individual previously associated with cybercrime and later reformed as a security professional has been apprehended in connection with an investigation into the hacker group ShinyHunters, as confirmed by Dutch authorities and the person’s employer on Monday. Dutch police announced the arrest of a 24-year-old individual linked to the inquiry, scheduled to appear in court in Rotterdam the following day. While the police statement did not disclose the individual’s identity, Benjamin Korper, the employer from Neo Security, an Amsterdam cybersecurity firm, identified the person as Pepijn van der Stap, serving as the company’s offensive security lead.
In a conversation with Reuters, Korper disclosed that Dutch forensic investigators visited their office on September 15, coinciding with Van der Stap’s arrest during a police operation on the same evening. Van der Stap’s past convictions in 2023 for data theft and extortion received significant attention, alongside his subsequent renunciation of cybercrime. Korper mentioned that Van der Stap underwent a thorough screening process before being hired, expressing shock at the recent arrest, stating, “Absolutely everybody I talked to is flabbergasted.”
A representative from ShinyHunters informed CBC News that Van der Stap has no ties to their group, criticizing Dutch law enforcement as “unskilled and incompetent.” The ongoing police investigation stems from a cyberattack on Odido, a Dutch telecoms company, in February, claimed by ShinyHunters. Despite suspicions, investigations by an external firm hired by Korper have not uncovered any evidence of Van der Stap compromising Neo Security or its clientele.
Korper noted no contact with Van der Stap post-arrest, with Reuters’ attempts to reach the individual or their legal representation proving unsuccessful. The initial report of Van der Stap’s arrest was made by independent journalist Brian Krebs. ShinyHunters is notorious for orchestrating large-scale data breaches and extortions, notably claiming responsibility for hacking the FBI and accessing sensitive information about agency personnel.