DUTCH police have arrested a 24-year-old man from Amsterdam as part of an investigation into the ShinyHunters cybercrime group. He was due to appear before Rotterdam District Court on 29 September 2026. KrebsOnSecurity and other sources identified the suspect as Pepijn van der Stap, previously known online as “Umbreon”. He was convicted in 2023 over data theft and extortion affecting more than a dozen companies, receiving a four-year prison sentence with one year suspended and three years’ probation. Police searched his Amsterdam home on 15 September and seized electronic devices.
The alleged link to ShinyHunters centres on the Umbreon alias and Pokémon-themed imagery used on hacking forums and in material associated with attacks attributed to the group. However, the article says the evidence remains disputed: the imagery may predate van der Stap’s use of the alias, while sources told KrebsOnSecurity it could have been used by ShinyHunters leader “Rey” to implicate him.
Dutch police are separately investigating ShinyHunters’ breach of mobile operator Odido, in which an employee was reportedly tricked into entering credentials on a fraudulent login page. The incident exposed data relating to more than 6.2 million Dutch people, but no evidence or charges linking van der Stap personally to that breach had been presented. Mandiant told KrebsOnSecurity that ShinyHunters could collect nearly $100 million in extortion payments during 2026.