Day: September 29, 2026
 |
Michael_Novakhov shared this story . |
A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken on March 1, 2017. REUTERS/Kacper Pempel/Illustration Purchase Licensing Rights, opens new tab
- Summary
- Dutch police say suspect, 24, to appear in Rotterdam court
- Former boss identifies suspect as ex-hacker Pepijn van der Stap
- Memo says FBI presumes hackers have stolen data on all employees
AMSTERDAM, Sept 28 (Reuters) – A Dutch man whose journey from cybercriminal to reformed security professional was widely covered in the international media has been arrested as part of an investigation into the hacker group ShinyHunters, Dutch police and the man’s boss said on Monday.
In a statement, opens new tab
posted to social media site X, Dutch police said a 24-year-old man had been arrested in connection with the inquiry and would appear in court in Rotterdam on Tuesday.
The Misinformation Monitor newsletter rounds up international misinformation narratives, with a “Real or Fake?” quiz in every edition. Sign up here.
The statement did not name the man. But Benjamin Korper of Amsterdam-based cybersecurity company Neo Security said it was Pepijn van der Stap, the company’s offensive security lead.
In a telephone interview with Reuters, Korper said Dutch forensic investigators visited his office on September 15, the night Van der Stap was arrested in a dramatic police raid that
involved flash bang grenades, opens new tab
.
The arrest comes amid escalating concern over ShinyHunters, a hacking group known for large-scale data breaches and extortion, and its recent theft of what it said was terabytes of sensitive personnel data from US FBI servers. At least some of the data includes employees’ intelligence assignments and medical records, Reuters has reported. Some compared this to the disastrous 2015 hack of the US Office of Personnel Management.
An internal memo circulated to staffers said the FBI was operating under the presumption that hackers stole data pertaining to all bureau employees, according to a person briefed on the matter. In a statement, the FBI said it was “working around the clock” to investigate the hack and was “in regular communication with anyone who may be impacted.” The memo’s existence was earlier reported by MS Now.
In a statement, ShinyHunters said Van der Stap had “no association” with the group and that Dutch police were incompetent. The hackers said that now they were not setting a deadline for the FBI to rescind
an advisory about ShinyHunters, opens new tab
, softening their initial statement which gave the FBI a week.
“This was not a threat,” they said. “Nothing will happen.”
News of Van der Stap’s arrest,
by independent journalist Brian Krebs, caused a stir in the cybersecurity community.
Van der Stap’s 2023 convictions of data theft and extortion had already received widespread publicity, as did his subsequent public disavowal of cybercrime. On his personal website, Van der Stap acknowledged that his journey “hasn’t been a straight line” but said his experience had taught him that “knowledge is for building and protecting, not breaking.”
Korper said he had carefully vetted Van der Stap before hiring him, monitored him during his employment, and was shocked by the arrest.
“I truly believe that people deserve a second chance, but in this case I was not thanked for it,” Korper said. “Absolutely everybody I talked to is flabbergasted.”
The executive said he had hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but so far investigators have found no evidence that he acted against his employer or its clients.
Korper and Van der Stap have not been in touch since the arrest, Korper said. Attempts by Reuters to reach Van der Stap or identify a lawyer or representative were not successful.
Adds comment from FBI in paragraph 6
Reporting by Anthony Deutsch in Amsterdam, and Raphael Satter and Andrew Goudsward in Washington; Additional reporting by AJ Vicens in Detroit. Writing by Makini Brice and Raphael Satter; Editing by Andrew Heavens, David Gaffen and David Gregorio
Our Standards: The Thomson Reuters Trust Principles., opens new tab