AMSTERDAM - A Dutch man whose journey from cybercriminal to reformed security professional was widely covered in the international media has been arrested as part of an investigation into the hacker group ShinyHunters, Dutch police and the man’s boss said on Monday. In a statement posted to social media site X, Dutch police said a 24-year-old man had been arrested in connection with the inquiry and would appear in court in Rotterdam on Tuesday. The statement did not name the man. But Benjamin Korper of Amsterdam-based cybersecurity company Neo Security said it was Pepijn van der Stap, the company’s offensive security lead. In a telephone interview with Reuters, Korper said Dutch forensic investigators visited his office on Sept. 15, the night Van der Stap was arrested in a dramatic police raid that involved flash bang grenades. The arrest comes amid escalating concern over ShinyHunters, a hacking group known for large-scale data breaches and extortion, and its recent theft of what it said was terabytes of sensitive personnel data from U.S. FBI servers. At least some of the data includes employees’ intelligence assignments and medical records, Reuters has reported. Some compared this to the disastrous 2015 hack of the U.S. Office of Personnel Management. An internal memo circulated to staffers said the FBI was operating under the presumption that hackers stole data pertaining to all bureau employees, according to a person briefed on the matter. In a statement, the FBI said it was “working around the clock” to investigate the hack and was “in regular communication with anyone who may be impacted.” The memo’s existence was earlier reported by MS Now. In a statement, ShinyHunters said Van der Stap had “no association” with the group and that Dutch police were incompetent. The hackers said that now they were not setting a deadline for the FBI to rescind an advisory about ShinyHunters, softening their initial statement which gave the FBI a week. “This was not a threat,” they said. “Nothing will happen.” News of Van der Stap’s arrest, first reported by independent journalist Brian Krebs, caused a stir in the cybersecurity community. Van der Stap’s 2023 convictions of data theft and extortion had already received widespread publicity, as did his subsequent public disavowal of cybercrime. On his personal website, Van der Stap acknowledged that his journey “hasn’t been a straight line” but said his experience had taught him that “knowledge is for building and protecting, not breaking.” Korper said he had carefully vetted Van der Stap before hiring him, monitored him during his employment, and was shocked by the arrest. “I truly believe that people deserve a second chance, but in this case I was not thanked for it,” Korper said. “Absolutely everybody I talked to is flabbergasted.” The executive said he had hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but so far investigators have found no evidence that he acted against his employer or its clients. Korper and Van der Stap have not been in touch since the arrest, Korper said. Attempts by Reuters to reach Van der Stap or identify a lawyer or representative were not successful. (Reporting by Anthony Deutsch in Amsterdam, and Raphael Satter and Andrew Goudsward in Washington; Additional reporting by AJ Vicens in Detroit. Writing by Makini Brice and Raphael Satter; Editing by Andrew Heavens, David Gaffen and David Gregorio)
