Dutch Authorities Confirm Arrest in ShinyHunters Probe
Dutch police have confirmed the arrest of a 24-year-old man from Amsterdam as part of an ongoing investigation into the ShinyHunters hacking collective. The arrest took place earlier this month, with authorities stating the suspect is being held in connection with the group’s cybercriminal activities. The Politie Landelijke Opsporing en Interventies confirmed the detention in a statement released on Monday, emphasizing that the investigation remains active.
The suspect has been identified by cybersecurity journalists Brian Krebs of KrebsOnSecurity and the DataBreaches platform as Pepijn van der Stap, a Dutch national previously known online by the alias "Umbreon." This identification aligns with prior reporting linking van der Stap to multiple hacking incidents and online forums where he used Pokémon-themed imagery, particularly the Umbreon character, as part of his online persona.
History of Prior Arrests and Convictions
Van der Stap is not a first-time offender. In January 2023, he was arrested and subsequently charged with hacking and extortion targeting over a dozen companies across the Netherlands and internationally. After pleading guilty, he was sentenced to four years in prison, with one year suspended, followed by a three-year probationary period subject to strict conditions. This prior conviction establishes a clear pattern of malicious cyber activity.
His most recent arrest occurred on September 15, when a Dutch tactical police unit executed a search warrant at the Amsterdam residence he shared with his mother. During the raid, officers seized multiple electronic devices believed to be relevant to the ongoing investigation. The timing and nature of the seizure suggest authorities are gathering digital evidence tied to alleged involvement with ShinyHunters.
Link to ShinyHunters and the "Umbreon" Alias
Investigators are examining a potential connection between van der Stap and ShinyHunters, a hypothesis supported by sources familiar with the case who spoke to KrebsOnSecurity. A key point of interest is the reuse of the "Umbreon" alias and associated Pokémon imagery. Van der Stap used this identity on hacking forums such as BreachForums as early as 2021.
Notably, the same Umbreon character appeared in a 2020 defacement of the HackForums website — predating van der Stap’s known use of the alias by a year. This temporal discrepancy has raised questions about whether the imagery was adopted, shared, or misattributed, though investigators continue to assess its significance in linking the suspect to ShinyHunters’ recent operations.
ShinyHunters has reportedly used the Umbreon motif in high-profile attacks, including a recent breach involving the FBI and the defacement of the Clop ransomware group’s data leak site. These incidents have contributed to the theory that the symbol may serve as a tactical signature or points of coordination, though no definitive proof linking van der Stap to these specific acts has been publicly presented.
Unrelated Voice Evidence and Denials from ShinyHunters
In a separate development, Dutch police previously released an audio recording of a Dutch-speaking individual suspected in the Odido telecommunications breach. In the recording, the speaker impersonated an IT technician to trick an employee into revealing credentials via a fake login page. Both DataBreaches, which claims to have spoken with van der Stap on multiple occasions, and a close associate of the suspect have stated that the voice in the recording does not match van der Stap’s.
When approached for comment, a representative claiming to speak for ShinyHunters explicitly denied any affiliation with van der Stap. The individual stated, "That individual has no association with us. Frankly, we are laughing," dismissing the connection as unfounded. This denial adds complexity to the narrative, suggesting either a lack of involvement or an attempt to distance the group from the suspect amid ongoing scrutiny.
The case remains active, with the suspect scheduled to appear before the Rotterdam District Court on Tuesday, September 29. Authorities indicated that additional details may be disclosed at that time. As of now, no formal charges related to ShinyHunters have been filed, and the investigation continues to evolve.
Source: BleepingComputer