Dutch police confirmed on September 28, 2026 that they had arrested a 24-year-old man from Amsterdam as part of an investigation into ShinyHunters, the extortion group that has spent the back half of 2026 tearing through corporate and government networks, and a Dutch court has since ordered him held in pretrial detention while the case develops. The arrest, reported by Reuters and BleepingComputer, lands in the middle of a story that has already touched the FBI, a Dutch telecom carrier, and one of the most disruptive ransomware crews on the planet. It also arrived with a complication: ShinyHunters itself denied the suspect belonged to the group.
The suspect has not been formally named by Dutch police. But Benjamin Korper, who runs the Amsterdam security firm Neo Security, told Reuters the man is Pepijn van der Stap, an employee at his company who worked as an offensive-security lead, and Reuters reported he had in fact been detained since September 15. Korper said Dutch forensic investigators showed up at the Neo Security office on the night of the arrest, which he described as a raid involving stun grenades. Van der Stap previously went by the handle “Umbreon” and, per Reuters, had served three of four years of a prior hacking sentence before moving into legitimate security work, according to reporting from KrebsOnSecurity.
The case sits at the intersection of two ongoing storylines this site has tracked closely: the FBI’s own struggles with ShinyHunters-linked intrusions and the group’s broader pattern of hitting large organizations through third-party software flaws, as seen in the Oracle PeopleSoft WAF bypass earlier this year. What makes the September 28 arrest different is that, for the first time, Dutch authorities have a named suspect in custody rather than just a claim of responsibility posted to a leak site.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Dutch police actually confirmed
Dutch police’s public statement was narrow. They confirmed a 24-year-old man from Amsterdam had been arrested in an investigation connected to ShinyHunters, and said he would appear before a court in Rotterdam the following Tuesday, where a judge ultimately ordered 90 days of pretrial detention. That is close to the extent of what law enforcement itself has said on the record, according to Reuters and BleepingComputer, though TechCrunch reported that Dutch authorities accused him specifically of participating in a criminal organization. Police did not release the suspect’s name, did not detail further formal charges, and did not confirm a direct link to any specific breach, including the FBI incident.
Everything beyond that official statement, including the suspect’s identity, his employer, and the stun-grenade raid description, comes from secondary sources: his own employer speaking to Reuters, and unnamed sources cited by KrebsOnSecurity who said the man had been held for questioning since roughly September 16. That gap between the confirmed timeline (arrest around mid-September, public confirmation September 28) and the parts of the story still relying on unnamed sources is worth sitting with, because most of the more dramatic details, including any specific role in the FBI incident, still fall on the unconfirmed side of that line.
NL Times reported that Dutch investigators are examining a possible link between the suspect and the February 2026 cyberattack on Odido, one of the Netherlands’ major telecom carriers, for which ShinyHunters claimed responsibility. That Odido connection, not the FBI breach, appears to be the more direct thread investigators are pulling on, based on the available Dutch-language coverage.
The FBI breach claim ShinyHunters made right after
Timing is what turned a Dutch cybercrime arrest into an international story. Shortly after the suspect was taken into custody, ShinyHunters claimed it had compromised apply.fbijobs.gov, the FBI’s job-application portal, and said it had obtained personnel data covering more than 5,000 FBI employees, according to NL Times. KrebsOnSecurity described the group’s own claims as reaching into the terabytes, and by October 2026 the New York Times reported that the FBI had arrested a separate Canadian suspect in Pennsylvania in connection with data stolen from thousands of employees. This site covered the FBI side of that story separately when FBI job portals went offline and ShinyHunters claimed a 3TB hit, and again when the Bureau formally declared a cyber incident and notified 5,000 agents.
Here is the part that matters for anyone trying to connect the dots: the available reporting does not establish that the Amsterdam suspect had any role in the FBI intrusion. The two events are linked in time, not in evidence. ShinyHunters claimed the FBI breach after the arrest became known, and separately, the group told NL Times that the arrested Odido suspect was “not affiliated with the group” — a denial that directly contradicts what Dutch investigators appear to suspect. That contradiction had not been resolved as of September 29.
Readers should treat the ShinyHunters-FBI connection as three separate, unverified claims stacked on top of one confirmed arrest: first, that the suspect assisted ShinyHunters’ data theft and extortion operations; second, that this extends specifically to the Odido hack; and third, that either of those connects to the FBI breach claim. Only the arrest itself, and the fact that ShinyHunters made the FBI claim, are confirmed by named outlets.
Who is ShinyHunters, and why this arrest is unusual
ShinyHunters has built a reputation over the past several years as a data-theft and extortion operation, favoring large-scale breaches over the file-encrypting ransomware model that dominated the previous decade; by September 2026, TechCrunch and SecurityWeek reported that authorities had linked the group to attacks on more than 140 organizations worldwide since 2025. The group’s 2026 activity alone spans the Odido telecom hack in February, the Oracle PeopleSoft campaign that this site covered when ShinyHunters bypassed a web application firewall on a CVSS 9.8 bug, a return trip to Rockstar Games that leaked 8.1GB of anti-cheat source code, and the ongoing FBI saga.
KrebsOnSecurity also reported that ShinyHunters has been involved in extortion activity connected to the Russian ransomware group Cl0p, suggesting a level of coordination or overlap between groups that used to operate as fully separate crews. That pattern, loosely affiliated extortion actors sharing infrastructure, victims, or leak-site space, has become one of the defining features of the 2025-2026 data-extortion landscape, and it is part of why attributing any single intrusion to a single named individual is unusually hard.
What makes the Amsterdam arrest unusual is not the group being targeted, it is the profile of the suspect. If Neo Security’s account holds up, the man arrested was not an anonymous figure operating purely underground. He held a day job as an offensive-security lead, the kind of role that involves authorized penetration testing and red-teaming for paying clients. A previous cybercrime conviction followed by legitimate security employment is not unheard of in this industry, but it does raise the same question investigators and employers have wrestled with for years: how much oversight should exist when someone with that history holds credentials to sensitive systems.
Timeline of events
| Date | Event | Source |
|---|---|---|
| February 2026 | ShinyHunters claims responsibility for a cyberattack on Dutch telecom carrier Odido | NL Times |
| September 15, 2026 | Dutch forensic investigators visit Neo Security’s Amsterdam office; employer says suspect arrested that night in a raid involving stun grenades | Reuters |
| Around September 16, 2026 | Suspect reportedly held for questioning, per unnamed sources | KrebsOnSecurity |
| September 28, 2026 | Dutch police publicly confirm the arrest of a 24-year-old Amsterdam man in a ShinyHunters investigation; court appearance in Rotterdam announced | Reuters, BleepingComputer |
| September 28-29, 2026 | Dutch media link the investigation to the Odido hack; ShinyHunters denies the suspect is affiliated with the group | NL Times |
| September 29, 2026 | Story remains unresolved: no formal charges confirmed publicly, FBI breach link unverified | Reuters, NL Times, KrebsOnSecurity |
What’s confirmed versus what’s still allegation
| Claim | Status | Source |
|---|---|---|
| A 24-year-old Amsterdam man was arrested in a ShinyHunters investigation | Confirmed by Dutch police | Reuters, BleepingComputer |
| Suspect’s name is Pepijn van der Stap | Reported by employer, not confirmed by police | Reuters, KrebsOnSecurity |
| Suspect worked as offensive-security lead at Neo Security | Reported by employer | Reuters |
| Suspect has a prior cybercrime conviction | Reported, not independently verified here | KrebsOnSecurity |
| Suspect linked to the Odido telecom hack | Reported investigative angle | NL Times |
| Suspect involved in the FBI job-portal breach | Not established by any named source | N/A |
| ShinyHunters claims suspect is “not affiliated” with the group | Group’s own statement, disputed | NL Times |
| Formal charges filed against the suspect | Not publicly confirmed as of September 29 | Reuters, BleepingComputer |
How this compares to prior ShinyHunters-linked arrests
ShinyHunters, and the loosely connected constellation of actors sometimes grouped under the “Scattered Spider” and “Lapsus$”-adjacent labels, have proven difficult for law enforcement to pin down for a simple reason: the people involved often operate across jurisdictions, use rotating handles, and in some cases hold legitimate day jobs in the security industry that give them both technical cover and a plausible reason to be handling security tooling. The cross-border nature of the crackdown became even clearer on September 29, when The Register reported that Jordanian authorities had detained a separate suspect, Saif al-Din Khader, who goes by the alias “Rey,” in a parallel action against the same network. That last pattern echoes back to earlier UK arrests of Scattered Spider-linked teenagers, where investigators similarly struggled to separate a young suspect’s legitimate technical interests from alleged criminal activity.
What sets the Amsterdam case apart is the employer’s public cooperation. Rather than staying silent, Korper spoke to Reuters and confirmed the raid, the employee’s identity, and his role at the firm. That is a notably different posture than most companies take when an employee is swept up in a cybercrime investigation, and it suggests Neo Security is trying to get ahead of reputational damage rather than waiting for it to surface through leaked court documents.
It also mirrors a recurring theme in ShinyHunters coverage this year: the gap between what the group claims on its leak sites and what investigators or victim organizations can verify. This site tracked that same pattern when ShinyHunters said it had hacked the FBI and was holding 2-3TB of data, a figure that shifted depending on which report you read, and again when the group claimed it hit four FBI systems as “payback” for earlier law enforcement action against its members.
Why the FBI keeps showing up in this story
The FBI has had a rough year on the ShinyHunters front regardless of what role, if any, the Amsterdam suspect played. This site’s earlier coverage traced how the Bureau confirmed a cybersecurity incident after ShinyHunters claimed a 2TB data theft, and how the agency’s job-application infrastructure became a repeated target. The FBI’s own IC3 unit, the Internet Crime Complaint Center, has been the public-facing channel for reporting cybercrime tips connected to these campaigns, and its guidance remains a useful reference point for organizations trying to understand extortion-group tactics.
The recurring FBI targeting also raises a harder question for federal agencies generally: recruitment and job-application portals are, by design, public-facing and meant to collect personal data from a wide pool of applicants. That makes them a soft target compared to classified internal networks, and it is a pattern security researchers have flagged for years, not just in this case. A breach of a recruitment site does not mean core investigative systems were touched, but the personal data exposure risk for applicants and current employees is real regardless of which system was hit.
Market and industry impact
Arrests like this one rarely move markets the way a ransomware attack on critical infrastructure does, but they carry weight in the cybersecurity services industry specifically. Neo Security’s public entanglement in a ShinyHunters investigation, regardless of the eventual legal outcome for its employee, puts pressure on security consultancies more broadly to tighten background-check and access-control practices for staff who hold offensive-security roles. Firms offering penetration testing and red-team services routinely employ people with unconventional technical backgrounds, including some with past convictions who have since gone straight; this case will likely reopen internal debates at competing firms about how much scrutiny that history should receive before someone gets production access to client environments.
There is also a knock-on effect for cyber insurance underwriting. Insurers that price policies for companies exposed to extortion-group activity, including telecom operators like Odido and public-sector targets resembling FBI recruitment infrastructure, tend to treat high-profile arrests as a signal that law enforcement capacity against these groups is improving, which can modestly affect premium calculations over time. A single arrest does not shift the market on its own, but a pattern of them, combined with continued fallout from breaches like the F5 BIG-IP zero-day that exposed 14,700 systems earlier this year, feeds into how carriers model extortion-group risk going forward.
Historical context: from LAPSUS$ to ShinyHunters
The pattern of young, technically skilled suspects moving between criminal hacking and legitimate security work is not new. LAPSUS$, the extortion group that hit Okta, Nvidia, and Samsung in 2022, was eventually tied to teenagers in the UK, some of whom had reputations in security-adjacent online communities well before their arrests. ShinyHunters itself has been active since at least 2020, when it was linked to breaches at Tokopedia and Microsoft’s GitHub repositories, and has cycled through different extortion tactics as law enforcement pressure increased.
What has changed by 2026 is the group’s apparent willingness to target government recruitment infrastructure directly, rather than sticking exclusively to corporate victims with the ability to pay a ransom. That shift, visible across this year’s FBI-related claims, suggests either a change in strategy toward reputational damage and embarrassment as leverage, or simply opportunistic targeting of whatever systems prove easiest to reach. Both explanations are consistent with the group’s history of favoring maximum disruption over a narrowly targeted approach.
What happens next in the Dutch legal process
Under Dutch criminal procedure, a suspect can be held for questioning for a period before prosecutors decide whether to formally charge them, and the scheduled Rotterdam court appearance is typically the point where a judge reviews whether continued pretrial detention is justified rather than a trial itself. That means the September 29 status of “arrested and held, court appearance scheduled” is very likely to change quickly, either toward formal charges and continued detention, or toward release pending further investigation if prosecutors decide the evidence does not yet support charges.
Readers should expect the more consequential updates, whether charges are filed, what those charges specifically allege, and whether any FBI-related conduct is included, to come out of that Rotterdam court process rather than from further ShinyHunters leak-site posts. Leak-site claims, including the group’s own denial that the suspect is affiliated with it, carry no evidentiary weight on their own and have a track record, across this group’s 2026 activity, of shifting details between initial claims and later verification.
Predictions: where this story goes from here
- Dutch prosecutors will likely announce whether formal charges apply within days to a few weeks of the Rotterdam court appearance, given the public attention the case has already drawn.
- ShinyHunters will probably continue denying the suspect’s affiliation publicly, regardless of what Dutch investigators conclude, since the group has consistently used its leak-site channel to shape narrative independent of law enforcement statements.
- Expect renewed scrutiny of background-check practices at offensive-security and penetration-testing firms across Europe, particularly for staff with prior cybercrime convictions who now hold client-facing access.
- The FBI breach claim will likely remain unresolved publicly for some time; agencies rarely confirm the technical specifics of personnel-data incidents while an investigation is active, which matches the pattern seen in this site’s earlier coverage of the Bureau’s cyber incident declaration.
- Additional arrests tied to the Odido hack or the broader ShinyHunters network are plausible but not guaranteed; the available reporting identifies only one arrest so far, and prior ShinyHunters-adjacent cases have sometimes taken months to produce follow-on detentions.
What security teams should take from this
For IT and security teams, the practical takeaway is less about this specific suspect and more about the pattern his case fits into. ShinyHunters and similar groups continue to favor credential theft, third-party software flaws, and social engineering over custom malware, which means the defensive priorities that mattered a year ago, patching internet-facing systems quickly, monitoring for anomalous access from privileged accounts, and applying multi-factor authentication universally, still matter now. Organizations running network monitoring tools like Zeek for traffic visibility or a SIEM platform such as Wazuh are generally better positioned to catch the kind of lateral movement these groups rely on before data actually leaves the network.
Public-sector IT teams specifically should treat recruitment and job-application portals as part of the attack surface, not a low-priority afterthought, given how often ShinyHunters and comparable groups have targeted exactly that kind of system this year. The gap between “core network compromised” and “recruitment website compromised” matters enormously for incident severity, but attackers do not need to distinguish between the two to cause real damage to the people whose personal data sits in either system.
Frequently asked questions
Who was arrested in the ShinyHunters investigation?
Dutch police confirmed the arrest of a 24-year-old man from Amsterdam on September 28, 2026. His employer, Benjamin Korper of Neo Security, told Reuters the suspect is Pepijn van der Stap, an offensive-security lead at the firm. Dutch police have not officially released his name.
Is the suspect confirmed to be behind the FBI data breach?
No. The available reporting from Reuters, NL Times, and KrebsOnSecurity does not establish that the suspect participated in the FBI job-portal breach. ShinyHunters claimed that breach after the arrest became public, but no named source has confirmed a direct link between the suspect and that specific incident.
Has the suspect been formally charged?
Not as of September 29, 2026, according to the available reporting. He was scheduled to appear before a court in Rotterdam, where a judge would typically review pretrial detention rather than hold a full trial.
What is ShinyHunters’ response to the arrest?
According to NL Times, ShinyHunters stated that the arrested suspect is not affiliated with the group, directly contradicting the investigative angle Dutch authorities appear to be pursuing regarding the Odido telecom hack.
What is the Odido hack, and how does it connect to this arrest?
Odido is a major Dutch telecom carrier that suffered a cyberattack in February 2026, for which ShinyHunters claimed responsibility. NL Times reported that Dutch investigators are examining whether the arrested suspect assisted in that attack, making it the more directly connected case compared to the FBI claims.
Did the suspect have a prior criminal record?
KrebsOnSecurity reported that the suspect had a previous cybercrime conviction before moving into legitimate offensive-security work under the Neo Security firm. This detail comes from source-based reporting rather than an official police statement.
What other organizations has ShinyHunters targeted in 2026?
ShinyHunters’ 2026 activity includes the Odido telecom hack, an Oracle PeopleSoft campaign involving a WAF bypass, a breach at Rockstar Games involving anti-cheat source code, and multiple claims involving FBI systems, including the job-application portal incident.
Where can I report suspected cybercrime activity related to these groups?
In the United States, the FBI’s Internet Crime Complaint Center (IC3.gov) is the designated channel for reporting cybercrime. In the Netherlands, tips can go through the national police at politie.nl, and cross-border cybercrime cases often involve coordination through Europol.
Related
- FBI Job Portals Stay Offline, ShinyHunters Claims 3TB Hit [2026]
- FBI Declares ‘Cyber Incident,’ 5,000 Agents Notified [2026]
- ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug [2026]
- ShinyHunters Say They Hacked FBI, Hold 2-3TB Data [2026]
- ShinyHunters Hit 4 FBI Systems, Calls Hack Payback [2026]
- ShinyHunters Breach Rockstar Again, Leak 8.1GB Code [2026]
Related Coverage
- FBI Confirms Breach: ShinyHunters Claims 2TB Stolen [2026]
- FBI Job Portals Stay Offline, ShinyHunters Claims 3TB Hit [2026]
- The Business Case for Passkeys: Cutting Help Desk Costs and Breach Risk
- FBI Declares 'Cyber Incident,' 5,000 Agents Notified [2026]
- ShinyHunters Bypass WAF on CVSS 9.8 PeopleSoft Bug [2026]
