A man from the Netherlands, who transitioned from being a cybercriminal to a reformed security expert, has been apprehended as part of an investigation into the hacking group ShinyHunters, according to Dutch law enforcement and the man’s employer. The Dutch police announced that a 24-year-old individual was arrested in connection with the probe and is scheduled to appear in court in Rotterdam the following day. Although the police did not disclose the man’s identity, Benjamin Korper, the head of Neo Security, a cybersecurity company in Amsterdam, confirmed that it was Pepijn van der Stap, the company’s offensive security lead.
Korper revealed in an interview that Dutch forensic investigators visited their office on September 15, coinciding with Van der Stap’s arrest during a police operation. Van der Stap’s previous convictions in 2023 for data theft and extortion garnered significant media attention, along with his subsequent renunciation of cybercrime. Korper expressed shock at the arrest, stating that he had thoroughly vetted Van der Stap before hiring him, and the news has left everyone he spoke to astounded.
A representative of ShinyHunters informed CBC News that Van der Stap has no affiliation with their group and criticized the Dutch police as “unskilled and incompetent.” The representative emphasized that Van der Stap’s alleged involvement was baseless and dismissed any connection between him and their activities.
The investigation stemmed from a cyberattack on Dutch telecommunications company Odido in February, which ShinyHunters claimed responsibility for. Korper disclosed that an external firm was engaged to probe any potential unauthorized access by Van der Stap to Neo Security or its clients. However, thus far, there has been no evidence indicating any wrongdoing against the company or its customers.
Korper mentioned that he has had no contact with Van der Stap since the arrest. Efforts by Reuters to reach Van der Stap or his legal representation were unsuccessful at the time of reporting. The news of Van der Stap’s arrest was initially disclosed by independent journalist Brian Krebs.
ShinyHunters has gained notoriety for conducting large-scale data breaches and extortion schemes, notably for the purported breach of the FBI, where they claimed to have obtained sensitive information about current and former FBI personnel.