ShinyHunters hacker arrest tied to alleged FBI framing, sources say | #cybercrime | #infosec

A “former” member of ShinyHunters is arrested (again) by Dutch authorities just days before the extortion gang claimed a massive hack of the FBI – but insiders say it could all be part of an elaborate setup by the alt spinoff “Scattered Lapsus$ Hunters” and its so-called leader to gain control over the group’s branding.

The FBI on Tuesday publicly identified van der Stap as “one of the alleged leaders” of ShinyHunters, officially announcing the arrest alongside Dutch authorities.

Assistant Director of the FBI Cyber Division Brett Leatherman posted a video statement on X, accusing the extortion gang of breaching more than 140 organizations and collecting at least $70 million in ransom payments in the past 12 months alone.

Ironically, Leatherman, along with FBI Director Kash Patel, were personally named in the ShinyHunters’ original FBI hack notice posted on its leak site September 22nd.

The hacker group claimed it was “severely offended” by the “circulation of disinformation” in an FBI cyber alert about the gang from May – explaining its motivation for the cyberattack.

On the arrest however, ShinyHunters denied any connection to van der Stap in a statement to Cybernews on Monday.

“That individual has no association with us. Frankly, we are laughing,” the group said, calling Dutch police “unskilled and incompetent.”

Dutch police are chasing attention and public favour after the massive embarrassment in result of the Odido hack. They want to seem like they are ahead of the FBI in investigating ShinyHunters,

ShinyHunters further claimed to Cybernews.

After going public with the arrest on Tuesday, the Netherlands’ High-Tech Crime Team revealed van der Stap is also suspected in connection with two planned murders abroad.

Dutch police say “a large amount of information found on his laptop” indicates van der Stap ordered hits on both intended victims.

The alleged murder plot is said to be unrelated to the ShinyHunters investigation.

The arrest took place around September 15th, according to a report published Monday by Brian Krebs, who first identified the hacker as 24-year-old Pepijn van der Stap from the Almere/Lelystad area near Amsterdam.

Van der Stap is currently being held for questioning in connection with the February hack of Odido, the Netherlands’ largest mobile service provider.

ShinyHunters, which reportedly breached the telecom provider through a sophisticated IT help desk social engineering attack, made off with the sensitive data of 6.2 million Odido customers – including bank account numbers and government IDs – publishing the massive cache on its dark leak site days later.

Authorities have not publicly confirmed whether van der Stap is the Dutch-speaking man heard on the recording.

What makes the timing of the arrest a bit more than coincidental is that van der Stap is no stranger to Dutch authorities.

The self-admitted ShinyHunters hacker was previously arrested in January 2023 and later sentenced to four years in prison – one year suspended – for his role in multiple ShinyHunters-claimed breaches over the years, raking in an estimated $1.5 to $2.7 million in ransom.

Released from prison in December 2025, van der Stap claims he has reformed from his “Dr. Jekyll-and-Mr. Hyde” cybercriminal lifestyle as a member of the prolific gang and now works as an offensive security lead at the Dutch company Neo Security, his LinkedIn profile shows.

Meanwhile, Krebs reported Monday that sources familiar with the investigation believe the FBI hack may have been part of an attempt by a rival ShinyHunters faction to frame van der Stap, whose former online alias was “Umbreon,” a popular Pokémon character.

ShinyHunters used the “Umbreon imagery” during its September 18–19 attack on rival ransomware gang Cl0p, as well as the targeted attack against the FBI on September 22nd – both taking place just days after van der Stap was taken into custody and well before news of his arrest became public.

According to Krebs, van der Stap has since become embroiled in a dispute with “Rey” – the alleged mastermind behind the Scattered Lapsus$ Hunters spinoff – all over control of the ShinyHunters name and branding.

Sources cited by Krebs claim the rival faction may have deliberately used van der Stap’s former “Umbreon” hacker identity to implicate him.

Meanwhile, in a separate statement to Cybernews Monday, ShinyHunters said it never intended to publish the FBI data it stole in the hack and that the one-week ultimatum it had given the FBI to remove what is called “false allegations” about the group was simply a “marketing campaign” to protect its business.

The group was blamed for exfiltrating some 2T to 3T of FBI data – a portion since confirmed to be authentic by independent researchers – potentially risking the sensitive personal information of roughly 38,000 FBI agents, employees, and their spouses, as well as all FBI job applicants.