Press play to start listening
A 24-year-old Dutch man arrested as part of an investigation into ShinyHunters is now also suspected of attempting to arrange two murders abroad, according to Dutch authorities. The alleged murder plot is being investigated separately from the cybercrime case.
Police said the man was arrested on suspicion of participating in a criminal organization as part of a wider investigation into ShinyHunters. Dutch authorities have not publicly named him, but multiple sources previously identified him as Pepijn van der Stap, a convicted Dutch hacker and security researcher whose arrest Hackread.com reported on Monday.
Laptop Led to Separate Murder Investigation
The murder allegations surfaced after Van der Stap’s September 15 arrest. Police said investigators found a large amount of information on his laptop, including material concerning two murders that were supposed to take place abroad.
“There are indications that the suspect ordered those killings,” Dutch police said in a press release. Authorities now suspect him of attempted solicitation of two murders.
Police have not disclosed the identities of the intended victims, the countries involved, a suspected motive or whether anyone else was allegedly recruited to carry out the killings. However, authorities have seized several data-storage devices that remain under examination, while further arrests have not been ruled out.
A Rotterdam court ordered Tuesday that the suspect remain in pretrial detention for another 90 days as the investigation continues.
Arrest Was Not Over the Odido Hack
Early reports linked Van der Stap’s arrest to the February 2026 Odido breach, but Dutch police have now explicitly separated the two investigations.
“The ShinyHunters group is responsible for a large number of national and international victims. It is good that we have been able to arrest a suspect in the investigation into this group. The suspect was not arrested in the investigation into the hack at Odido,” said Stan Duijf, a cybercrime investigator for the Dutch Police.
ShinyHunters claimed responsibility for the Odido attack, which resulted in personal information belonging to millions of customers being stolen. The group subsequently published stolen data after the telecom company refused to pay.
Van der Stap came to the attention of Team High Tech Crime during its wider inquiry into ShinyHunters. The unit operates under the Dutch National Investigation and Intervention Unit and the authority of the National Public Prosecutor’s Office.
FBI Calls Suspect an Alleged ShinyHunters Leader
The FBI has gone further than Dutch authorities in describing Van der Stap’s suspected position within the group.
FBI Director Kash Patel said Tuesday that Dutch police had arrested “one of the alleged leaders of ShinyHunters,” adding that FBI investigators were working with their Dutch counterparts on the case.
“As we speak, FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” Patel said on X.
Dutch police have been more reserved. Their statement says the suspect is believed to have played “a role” within ShinyHunters and does not describe him as a leader.
ShinyHunters has denied that Van der Stap belongs to the group. Responding to Hackread.com following reports identifying him as the arrested suspect, the group said: “That individual has no association with us.”
The group’s denial differs from the position taken by Dutch investigators and Patel’s characterization of Van der Stap as an alleged leader. Authorities have not publicly disclosed the evidence they say connects him to ShinyHunters.
Previously Convicted for Hacking and Extortion
Van der Stap was previously convicted in the Netherlands in 2023 for cybercrime offences involving hacking, data theft, extortion and money laundering. After leaving prison, he returned to professional cybersecurity work and most recently served as offensive security lead at Neo Security.
Neo Security CEO Benjamin Korper told Reuters that forensic investigators visited the company’s office on September 15, the same day Van der Stap was arrested during a police operation at his home.
Korper said the company commissioned an external investigation into whether its systems or customers had been compromised, with no evidence of such activity found at the time of his comments.
