Dutch man arrested in ShinyHunters investigation alleged to have been 'reformed hacker'

A Dutch man whose journey from cybercriminal to reformed security professional was widely covered in the international media has been arrested as part of an investigation into the hacker group ShinyHunters, Dutch police and the man's boss said on Monday.

In a statement posted to X/twitter, Dutch police said that a 24-year-old man had been arrested in connection with the inquiry and would appear in court in Rotterdam on Tuesday.

The statement did not identify the man by name, but his boss, Benjamin Korper of Amsterdam-based cybersecurity company Neo Security, said it was Pepijn van der Stap, the company's offensive security lead.

In a telephone interview with Reuters, Korper said his office was visited by Dutch forensic investigators on September 15, the same night Van der Stap was arrested in a police raid.

Van der Stap's 2023 convictions of data theft and extortion received widespread publicity, as did his subsequent disavowal of cybercrime. Korper said he had carefully vetted Van der Stap before hiring him and was shocked by the arrest.

"Absolutely everybody I talked to is flabbergasted,” he said.

No evidence of Van der Stap hacking employer

He said he had hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but so far investigators have found no evidence that he acted against his employer or its clients.

Korper said he had not been in touch with Van der Stap since the arrest. Attempts by Reuters to reach Van der Stap or identify a lawyer or representative were not immediately successful.

News of Van der Stap's arrest was first reported by independent journalist Brian Krebs.

ShinyHunters is a hacking group known for large-scale data thefts and extortion, most notable of late for the alleged hack of the FBI, where it boasted of stealing a large amount of data about current and former FBI employees.