A Dutch man, widely known for his journey from cybercriminal to reformed security professional, has been arrested as part of an investigation into the notorious hacker group ShinyHunters. Dutch police confirmed the arrest of a 24-year-old on Monday, appearing in court in Rotterdam the following day. While authorities did not name the individual, Benjamin Korper, head of Amsterdam-based cybersecurity company Neo Security, identified him as Pepijn van der Stap, the firm’s offensive security lead. Neo Security is an Amsterdam-based firm providing various cybersecurity services to clients.
Korper informed Reuters that Dutch forensic investigators visited his office on September 15, the night Van der Stap was apprehended in a dramatic police raid. This arrest highlights escalating concerns over ShinyHunters, a hacking collective known for large-scale data breaches and extortion. The group recently claimed the theft of terabytes of sensitive personnel data from US FBI servers, reportedly including employees’ intelligence assignments and medical records. This incident drew comparisons to the disastrous 2015 hack of the US Office of Personnel Management.
ShinyHunters, in a public statement, vehemently denied any association with Van der Stap, criticising Dutch police competence. They also rescinded an earlier deadline for the FBI to withdraw an advisory about their activities, stating, “Nothing will happen.” News of Van der Stap’s arrest, initially reported by journalist Brian Krebs, generated considerable discussion within the global cybersecurity community. His 2023 convictions for data theft and extortion, coupled with his public disavowal of cybercrime, garnered significant international media attention.
Benjamin Korper stated he thoroughly vetted and monitored Van der Stap, expressing deep shock. “I truly believe that people deserve a second chance,” Korper remarked. An external firm has since been engaged to investigate any potential compromises to Neo Security or its clients, though no evidence of wrongdoing against his employer or its clients has been found to date.
