DUTCH national Pepijn van der Stap, previously convicted of hacking, extortion, handling stolen data, distributing Tortilla ransomware and money laundering, has been arrested again. The 23-year-old was detained on 15 September 2026 after the Dutch Dienst Speciale Interventies (DSI) raided the Amsterdam home he shared with his mother. Police seized electronic devices, and he has since been held at a detention centre in Houten.
Authorities have not publicly disclosed the new charges, the alleged victims or the specific activity under investigation. DataBreaches reported that officials are examining a possible connection to the ShinyHunters cybercrime group, but stressed that no official claims or charges currently link Van der Stap to the group or to the ShinyHunters attack on telecommunications company Odido.
Speculation based on the use of an Umbreon Pokémon image and an audio recording has not been substantiated; a source and a close associate reportedly disputed that the voice was Van der Stap’s.
Van der Stap previously pleaded guilty and was sentenced in 2023 to four years in prison, with one year suspended, followed by three years of probation and conditions including reporting to probation services, daytime activities, debt counselling and outpatient treatment. The new arrest appears to have breached that probation.
DataBreaches said he is expected first to serve the suspended one-year term, with any sentence for the new case following it, although the investigation’s scope and allegations remain undisclosed.