Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Dutch authorities have arrested a 24-year-old convicted cybercriminal, identified by sources as Pepijn van der Stap, on suspicion of helping ShinyHunters with data thefts and extortion. KrebsOnSecurity reports that remaining group members escalated attacks after the arrest.
The arrest took place this month. In the days immediately following it, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p, KrebsOnSecurity reported.
Van der Stap was previously convicted in 2023 in connection with a string of data thefts and extortions that prosecutors said earned between 1.5 million euros and 2.7 million euros. At his trial in late 2023, he admitted that he lived a Dr. Jekyll and Mr. Hyde existence, secretly using the hacker handle Umbreon to extort victims and post their data on English-language hacking communities such as the now-defunct RaidForums and Breached.
By day, van der Stap worked as a software engineer at the Amsterdam-based cybersecurity startup Hadrian, while volunteering at the Dutch Institute for Vulnerability Disclosure, a nonprofit security research group. He confessed to his data theft and extortion activity and was sentenced to four years in prison, one of which was suspended.
After serving prison time for data theft and extortion, van der Stap publicly presented himself as a reformed hacker. In a Sept. 9 interview, KrebsOnSecurity reported, he claimed he was trying to turn his life around and make a positive contribution to society while working in offensive security and attempting to make amends to former victims.