Pepijn van der Stap presently works as Offensive Safety Lead at Dutch cybersecurity agency Neo Safety.
Dutch authorities have confirmed the arrest of a 23-year-old man as a part of their investigation into the February cyberattack towards telecom supplier Odido, an assault claimed by ShinyHunters. A number of sources have recognized the arrested man as convicted Dutch hacker and safety researcher Pepijn van der Stap.
The Dutch police media desk confirmed the arrest after experiences concerning the improvement appeared on Sunday. Police haven’t publicly named the suspect, however three sources aware of the investigation informed cybersecurity journalist Brian Krebs that the person in custody is Van der Stap. Sources cited by Krebs stated he was arrested on or round September 16 and has remained in custody for questioning.
The arrest follows a months-long investigation by the Dutch Nationwide Police and Public Prosecution Service into the Odido breach. ShinyHunters claimed duty for the assault, which uncovered info belonging to greater than six million clients after Odido refused to pay a ransom.
Odido Hack Started With a Cellphone Name
Investigators beforehand established {that a} Dutch-speaking man referred to as Odido customer support shortly earlier than the breach and pretended to work within the firm’s IT division. Utilizing inner terminology, the caller satisfied an worker that he wanted assist resolving a technical downside.
The worker was directed to a faux Odido login web page, the place the username and password have been entered. The caller then persuaded the worker to offer the extra verification code wanted to entry Odido’s inner programs.
Police launched a recording of the caller earlier this month and requested the general public for assist figuring out him. Authorities described the voice as real, Dutch-speaking and educated about IT, however haven’t publicly confirmed that Van der Stap is the individual heard within the recording.
ShinyHunters beforehand informed Dutch media that the individual within the recording was certainly one of its members and stated it could present him with authorized and monetary help.
Hackread.com reported in February that ShinyHunters initially printed two million Odido data after negotiations failed. The group claimed on the time that it had stolen significantly extra knowledge from the telecom supplier.
Who is Pepijn van der Stap?
Van der Stap has a documented historical past in each cybersecurity and cybercrime. In 2023, an Amsterdam court docket sentenced him to 4 years in jail, with one 12 months suspended, after he admitted involvement in hacking, knowledge theft and extortion. Prosecutors stated the felony exercise generated between €1.5 million and €2.7 million.
Throughout that interval, Van der Stap used the web title “Umbreon,” taken from the Pokémon character. A have a look at the alias’ exercise on cybercrime and hacking boards like RaidForums and Breached revealed it was being actively used for promoting stolen databases and extorting victims on hacking boards.
On the identical time, he labored as a software program engineer at cybersecurity firm Hadrian and volunteered with the Dutch Institute for Vulnerability Disclosure (DIVD).
Van der Stap was launched from jail in December 2025 and returned to cybersecurity work. Shortly earlier than his reported arrest, he was working as offensive safety lead at Dutch cybersecurity firm Neo Safety.
His personal web site presents him as a safety researcher and protocol engineer. Van der Stap writes that his previous taught him that safety data must be used for defense, and says he has submitted greater than 100,000 accountable disclosure experiences throughout his profession.
Krebs interviewed Van der Stap on September 9, a couple of week earlier than the reported arrest. Van der Stap described himself as having left cybercrime behind and stated he was making an attempt to contribute positively to cybersecurity whereas coping with civil claims and restitution ensuing from his earlier crimes.
Umbreon and the Current ShinyHunters Exercise
The Umbreon alias has turn out to be related once more as a result of the Pokémon character has featured prominently in latest ShinyHunters materials. As reported by Hackread.com, the defacement positioned on the FBI Jobs portal this month contained a big ASCII illustration of Umbreon. The identical character has appeared in different materials related with the group.
That alone doesn’t set up that Van der Stap participated within the FBI assault. Sources cited by Krebs described inner battle involving one other hacker generally known as “Rey” and instructed using Umbreon imagery may have been meant to affiliate the FBI operation with Van der Stap. Dutch authorities haven’t accused Van der Stap publicly of collaborating within the FBI breach.
The reported arrest additionally predates a number of aggressive actions attributed to ShinyHunters this month. Days after Van der Stap was reportedly detained, the group took management of Clop’s darkish internet leak website and demanded an eight-figure fee from the ransomware operation. ShinyHunters later defaced the FBI Jobs portal and claimed to have stolen delicate worker and applicant info.
Replace:
ShinyHunters Denies Van der Stap Is a Member
After publication, ShinyHunters responded to Hackread.com’s request for remark and denied that Van der Stap has any connection to the group. “That particular person has no affiliation with us. Frankly, we’re laughing,” ShinyHunters informed Hackread.com.
The group additionally criticised the Dutch police investigation, calling the authorities “unskilled and incompetent” and claiming they have been looking for publicity following the Odido breach. “Dutch police are chasing consideration and public favour after the huge embarrassment on account of the Odido hack. They wish to look like they’re forward of the FBI in investigating ShinyHunters,” the group stated.
The confirmed arrest issues the investigation surrounding the Odido assault, whereas Van der Stap’s identification because the suspect comes from sources aware of the case. The Dutch police investigation stays energetic, and authorities haven’t publicly detailed the proof towards him or confirmed whether or not he’s the Dutch-speaking caller whose voice was launched earlier this month.
