A hacker involved with ShinyHunters has been arrested in the Netherlands following the group’s alleged breach of the FBI.
Pepijn van der Stap, 24, was arrested around September 16 as Dutch authorities investigated suspected activity linked to ShinyHunters. Dutch police confirmed the arrest of a 24-year-old man but did not release his name.
Van der Stap’s boss, Benjamin Korper, confirmed to Reuters that the arrested man was Van der Stap. Korper said investigators also visited the company’s office after the arrest.
Van der Stap previously used the hacker name “Umbreon” and was convicted in 2023 for data theft and extortion. Prosecutors said his crimes involved stolen databases and generated between €1.5 million and €2.7 million.
He was sentenced to four years in prison, with one year suspended, and was released in December 2025.
After his release, Van der Stap moved into cybersecurity work. He was hired as the offensive security lead at Amsterdam-based cybersecurity company Neo Security and described himself as a reformed hacker who wanted to use his skills for legitimate security work.
His arrest came shortly before ShinyHunters claimed to have breached the FBI’s job application website and stolen sensitive information belonging to thousands of FBI employees.
The group’s attack on the FBI website included a defacement featuring the Pokémon character Umbreon, the same name Van der Stap previously used as a hacker.
However, KrebsOnSecurity reported that the image may have been deliberately used by another ShinyHunters member to make it appear that Van der Stap was responsible for the FBI attack.
Van der Stap’s previous criminal activity involved selling stolen databases and extorting victims. During a 2026 interview with KrebsOnSecurity, he said he was trying to move on from his past and make amends.
Dutch authorities have not publicly disclosed the specific allegations against Van der Stap or confirmed that he was involved in the FBI breach.