Dutch police arrest a security professional in the ShinyHunters hacking probe

Police arrested Pepijn van der Stap, who goes by the online alias "Umbreon," in Amsterdam on September 15. Officers deployed flashbang grenades during the operation.

• The suspect: 24 years old, reportedly employed in a company's offensive security division at the time of arrest.
• The history: convicted in January 2023 for hacking and extorting more than a dozen companies, sentenced to four years with one year suspended.
• The status: believed to have still been on probation from that earlier conviction when arrested again.

The catch: authorities haven't disclosed specific charges yet or confirmed which, if any, ShinyHunters attacks he's suspected of participating in.

The connection investigators are examining centers on his online alias. "Umbreon" is a Pokémon character, and authorities noted that imagery has recently been used by ShinyHunters itself in its own communications and branding.

That link is circumstantial rather than confirmed, and it's the kind of thin thread that has led to disputed attributions in past hacking investigations.

ShinyHunters publicly denied any connection to the arrested individual. In a statement to reporters, the group said: "That individual has no association with us. Frankly, we are laughing."

That kind of public denial is itself fairly typical behavior for a group willing to talk to journalists and defend its reputation, even mid-investigation. ShinyHunters has a track record of engaging directly with press coverage of its own activities rather than staying entirely silent.

The group's history explains why any arrest connected to it draws attention. ShinyHunters first became widely known in 2020 for large-scale data theft and extortion, and has escalated significantly since.

The Snowflake breach (2024): the group used stolen contractor credentials to access cloud data belonging to Snowflake customers, exposing records tied to Ticketmaster, AT&T, Santander Bank, and Neiman Marcus, among dozens of other organizations that lacked multi-factor authentication on affected accounts.

The Salesforce campaign (2025): ShinyHunters' most ambitious operation used stolen authentication tokens to access roughly 760 Salesforce customer organizations between August 8 and 18, 2025, exfiltrating an estimated 1.5 billion records. Victims included Google, Adidas, Cisco, Qantas Airways, and Allianz Life.

More recent activity: the group has also been linked to a breach of an FBI system, which ShinyHunters claimed was done to "protect our business," and a February 2026 breach of Dutch telecom provider Odido affecting 6.2 million customers.

ShinyHunters' recent campaigns haven't been a solo operation. Security researchers have documented an operational alliance between ShinyHunters, Scattered Spider, and LAPSUS$, three groups that have effectively merged into what's been called "Scattered LAPSUS$ Hunters."

The division of labor: ShinyHunters has confirmed Scattered Spider typically provides initial access to a target's systems, while ShinyHunters itself handles data exfiltration and the eventual data dumps or extortion. LAPSUS$ members have participated directly in high-profile campaigns, including both the Salesforce and Snowflake breaches.

All three groups are believed to draw membership from "The Com," a loosely organized, predominantly English-speaking cybercriminal ecosystem made up mostly of teenagers and people in their twenties who coordinate largely over Telegram and hacking forums rather than through any formal organizational structure.

The Odido intrusion, which hit a major Dutch telecom provider earlier this year, is especially relevant given this arrest happened on Dutch soil. It reportedly began with a social engineering call: a Dutch-speaking attacker impersonated an IT colleague to convince a customer service employee to hand over system access.

Dutch police released audio of that call publicly on September 8, just a week before this arrest, suggesting investigators had been actively working the Odido case and may have used leads from it in identifying this suspect.

Van der Stap's story had already been told once before this arrest, and not as a cautionary tale. His path from convicted hacker to security professional was widely covered in international media as a redemption story, and he had been working as offensive security lead at Neo Security, an Amsterdam-based cybersecurity company.

The earlier case: at his 2023 trial, van der Stap admitted to living what he described as a "Dr. Jekyll and Mr. Hyde" double existence, secretly operating under the "Umbreon" handle while building a legitimate security career. Prosecutors said his earlier hacking and extortion spree earned him between €1.5 million and €2.7 million.

That backstory is exactly why this new arrest is drawing attention well beyond typical hacking-case coverage. Dutch forensic investigators visited his workplace the same night he was arrested, suggesting authorities were specifically examining whether his professional access or tools played any role in the alleged renewed activity.

What makes this arrest notable beyond the ShinyHunters connection is the suspect's reported day job. Working in an offensive security role, testing companies' own defenses professionally, while separately facing suspicion of participating in major criminal breaches, is exactly the kind of dual identity security researchers have long worried about across the industry.

It's not a new pattern. Security research and criminal hacking draw on overlapping technical skills, and several past cases have involved security professionals moonlighting on the wrong side of that line. It's a reminder that professional credentials and criminal suspicion aren't mutually exclusive, however uncomfortable that overlap is for the companies employing people in sensitive security roles.

This arrest fits into a broader pattern Dutch authorities have flagged publicly. Police and prosecutors say they've noticed a rise in young, Western cybercriminals focused specifically on data and cryptocurrency theft, distinct from the state-linked threats the Netherlands also tracks.

The scale of the problem: Dutch authorities estimated roughly 2.5 million people in the Netherlands fell victim to cybercrime, online scams, threats, or harassment last year alone, a figure officials have described as part of a rapidly changing threat landscape.

The country's National High Tech Crime Unit handles complex cases involving major fraud, critical infrastructure, or international crime rings, exactly the profile this ShinyHunters-linked case fits. Notably, Dutch police also run a diversion program called Hack_Right, aimed at steering young, technically skilled offenders away from continued criminal hacking, an approach that underscores how often these cases involve very young suspects with genuine technical talent rather than traditional organized crime profiles.

Van der Stap was scheduled to appear before Rotterdam District Court on September 29, the same day this arrest was more broadly confirmed by Dutch police. Formal charges haven't been made public, and it remains unclear whether prosecutors will pursue a case specifically tied to ShinyHunters activity or something narrower.