Convicted Hacker Umbreon Arrested on Suspicion of Aiding ShinyHunters as Group Claims FBI Hack

Dutch police have arrested a 24-year-old man from Amsterdam in an investigation into the ShinyHunters hacking group. Police have not publicly identified him, but , citing three sources familiar with the investigation, reported that the suspect is Pepijn van der Stap, a convicted cybercriminal who previously used the alias 'Umbreon'.

The arrest was confirmed by the Dutch police national investigations unit on X. The force said the man was detained this month as part of the ShinyHunters investigation and would appear before the Rotterdam District Court on Tuesday 29 September. The closed hearing will determine whether he remains in custody.

Convicted Hacker Had Said He Was Reformed

KrebsOnSecurity reported that Van der Stap was arrested on or around 16 September and is suspected of helping ShinyHunters steal data and extort victims. Van der Stap was convicted in 2023 over a series of hacks and extortions that prosecutors said generated between €1.5 million and €2.7 million.

Van der Stap presented himself as a reformed hacker trying to turn his life around and said he was still dealing with civil claims and restitution related to his previous offences. He later stopped responding to messages. One source said that a colleague had seen authorities removing items from his home.

Dutch police have not publicly linked the suspect to any specific ShinyHunters attack. The distinction is important because the identification of Van der Stap as the arrested suspect has been reported by KrebsOnSecurity, rather than publicly made by Dutch police.

Umbreon Image Appeared on Defaced FBI Site

Days after the reported arrest, ShinyHunters claimed responsibility for an intrusion affecting the FBI's job application website. The group left an ASCII-style image featuring Umbreon, the Pokémon character associated with Van der Stap's former alias.

Sources close to the investigation believed the image may have been intended to associate the FBI incident with Van der Stap.

Those sources said a teenage member known as 'Rey' had been involved in a dispute with the Dutchman over control of the ShinyHunters brand and stolen data. The explanation remains an account from those sources, rather than a finding by Dutch police.

FBI Says It Is Investigating

The FBI said it was aware of claims involving unauthorised activity affecting FBIJobs.gov and was investigating. The agency said the cause of the incident was still undetermined.

ShinyHunters also sent news organisations a sample that appeared to contain information on roughly 5,000 FBI employees, including names, home addresses, phone numbers and information about relatives. The full scope of the claimed breach remained unclear, while the FBI said it was investigating the claims.

The group said the attack was linked to an FBI advisory issued in May that it disputes. It gave the bureau a week to retract or amend the warning.

The case also overlaps with an investigation into February's hack of Dutch telecom provider Odido. Dutch police said more than six million customers' data was obtained after a Dutch-speaking caller posed as an IT employee and directed a worker to a fake login page. After Odido refused to pay a ransom, the data was published on the dark web.

Police have not publicly said whether the man in custody is the caller whose voice was recorded. Tuesday's hearing will address his continued detention while the investigation proceeds.