Dutch Police Arrest ShinyHunters Hacker, Threat Actor Linked to Recent FBI Breach

What happened

On September 16, Dutch police arrested 24‑year‑old Pepijn van der Stap in Amsterdam. He is believed to be the former “Umbreon” hacker who was convicted in 2023 for multiple intrusions, data theft and extortion. Authorities say he was linked to the ShinyHunters group that recently targeted the FBI.

Impact

ShinyHunters has used stolen credentials, ransomware‑like extortion, and public‑facing data leaks to pressure victims. Victims include a range of private sector and government organizations that were forced to pay or risk disclosure. The group’s recent FBI breach suggests they can target high‑profile entities.

What to do

• Verify that all privileged accounts have strong, unique passwords and multi‑factor authentication.
• Review logs for signs of credential dumping or lateral movement that match ShinyHunters’ known techniques.
• Ensure backups are isolated and tested; consider immutable storage for critical data.
• Educate staff on phishing and social‑engineering tactics that can lead to credential compromise.
• Maintain an up‑to‑date inventory of all software and promptly apply security patches.

“The suspect was on supervised release after serving three years of a four‑year sentence,” Dutch police said. The arrest is part of a broader effort to dismantle the ShinyHunters network.