Dutch police arrest suspected ShinyHunters hacker Pepijn van der Stap over cybercrime and murder plots

Arrest and murder solicitation allegations

Dutch police arrested 24-year-old Pepijn van der Stap on 15 September 2026 during a raid using flash grenades at his parental home in Amsterdam. On 29 September 2026, a court in Rotterdam ordered his detention extended for an additional 90 days under full legal restrictions, allowing him contact only with his lawyer. Authorities suspect Van der Stap of participating in the cybercrime collective ShinyHunters, which has carried out extortion and data breaches worldwide. During the search, investigators seized digital devices and discovered files on his laptop that prompted a separate criminal investigation into the attempted solicitation of two contract murders abroad.

Arresting cybercrime suspects is a key intervention in our broad-based fight against this type of crime. The ShinyHunters group is responsible for a large number of victims, both in the Netherlands and abroad. It is gratifying that we have been able to arrest a suspect in the investigation into this group.

FBI claims and group denials

Following the announcement of the arrest, FBI Director Kash Patel stated on social media that Dutch and American authorities had detained an alleged leader of ShinyHunters. Patel said the operation resulted from close coordination between Dutch investigators and the FBI. However, official Dutch police statements did not mention direct US coordination or the recent claims regarding federal databases. Furthermore, Van der Stap was taken into custody six days before ShinyHunters claimed on 21 September 2026 to have breached internal FBI networks.

ShinyHunters publicly alleged that it had extracted records on approximately 38,000 FBI personnel, including intelligence assignments, home addresses, and medical records, by targeting an Oracle cloud infrastructure. In an email sent from an anonymous address, ShinyHunters stated that Van der Stap had no association with the group. The collective stated that its action against the FBI was not motivated by financial gain, but was carried out after the agency published a threat advisory about the group in May.

Past convictions and employer reaction

Van der Stap had previous contact with the Dutch judicial system beginning in his youth, when he compromised his high school network and entered the police diversion program Hack_Right. In 2023, police arrested him at age 20 behind his computer, leading to a four-year prison sentence for corporate data theft, extortion, and cryptocurrency money laundering. During his detention, he underwent treatment at a penitentiary psychiatric center for post-traumatic stress disorder and depression, while earning technical certifications and volunteering with the Dutch Institute for Vulnerability Disclosure (DIVD).

Toward the end of his prison sentence, Van der Stap secured employment as an ethical hacker at Amsterdam cybersecurity company Neo Security. The company confirmed his identity following his September arrest. Company founder Benjamin Korper stated that the firm had hired him deliberately as a rehabilitation opportunity before learning of the new charges.

We gave him a second chance in full awareness. Our trust is enormously damaged. I did not see this coming. If the suspicions prove true, it is exactly the same as last time. He has two faces.