Dutch police arrest suspect in ShinyHunters probe tied to Odido

On September 15, Dutch tactical police searched the Amsterdam home Pepijn van der Stap shared with his mother, arrested the 24-year-old and seized electronic devices. Police posted on X that a 24-year-old Amsterdam man was arrested in a ShinyHunters investigation and will appear before Rotterdam District Court on September 29, without naming him. KrebsOnSecurity and DataBreaches identified him as Van der Stap, Neo Security's offensive security lead. Brian Krebs first reported the arrest. Boss Benjamin Korper told Reuters forensic investigators visited Neo's office that night and an outside firm found no evidence Van der Stap acted against the company or clients. "Absolutely everybody I talked to is flabbergasted," he said. Van der Stap pleaded guilty in 2023 to hacking and blackmailing more than a dozen companies and received four years with one year suspended plus three-year probation. He used the alias Umbreon on BreachForums by 2021; ShinyHunters later used the same Pokémon character, though a 2020 HackForums defacement predated his alias. A ShinyHunters representative told BleepingComputer that individual has no association with them. DataBreaches said an Odido-hack voice recording police released did not sound like him. Police have not detailed the allegations or confirmed ties to specific attacks.