A 24-year-old man from Amsterdam has been arrested in connection with an investigation into the hacker group ShinyHunters, Dutch police confirmed this week. The suspect is scheduled to appear before the Rotterdam District Court on 29 September 2026, according to an official police statement posted on X.
Multiple independent sources, including Reuters and KrebsOnSecurity, have identified the man as Pepijn van der Stap. He was apprehended during a police raid around 15 or 16 September 2026, the same day Dutch forensic investigators visited Neo Security, the cybersecurity company where he is employed. His employer, Benjamin Korper, publicly acknowledged van der Stap’s arrest.
Van der Stap has a criminal record related to cybercrime, having been convicted in 2023 for data theft and extortion. He was released from prison in December 2025. The current investigation reportedly links him to the ShinyHunters hacking group and, more specifically, to a breach at Odido, a telecommunications firm. According to BleepingComputer, police allege that an employee was tricked into entering login credentials via a fake verification page during this incident.
Despite the widespread reporting and identification, the official police statement has not named van der Stap directly. The ShinyHunters group dismissed the arrest, stating, “That individual has no association with us. Frankly, we are laughing,” as quoted by BleepingComputer.
This arrest highlights ongoing efforts by Dutch authorities to clamp down on cybercrime, especially involving hacking collectives like ShinyHunters that have targeted numerous organisations globally. Van der Stap’s upcoming court appearance will be closely watched as investigators seek to clarify his role in the alleged attacks and the extent of his involvement.