A Dutch court Tuesday ordered a 24-year-old Amsterdam man held for at least 90 days on suspicion of taking part in the ShinyHunters data-extortion gang, while police examine separate evidence that he may have tried to arrange two murders abroad, TechCrunch reported. The suspect, a security professional with a prior hacking conviction, was arrested earlier this month.

What Happened

Dutch police confirmed Monday that the man had been detained as part of their ShinyHunters investigation, BleepingComputer reported, and said he would appear before the Rotterdam District Court Tuesday. Police have not named him. KrebsOnSecurity and DataBreaches identified him as Pepijn van der Stap, a Dutch hacker once known online as "Umbreon."

He was arrested on Sept. 15, according to TechCrunch and The Register. The formal suspicion is participation in a criminal organization, ShinyHunters. TechCrunch described him as chief technology officer at Neo Security, while SecurityWeek and The Register said he worked there as offensive security lead.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

Police said investigators found a large amount of material on his laptop, including information about two murders that were to be carried out abroad. The Register reported that police see indications the suspect gave the order. Authorities stressed that the murder inquiry is separate from the hacking case, and The Register said he is being held in full isolation while both proceed.

Police also said he is not believed to have been involved in the February breach of Dutch mobile carrier Odido, which exposed data on 6.2 million customers. Investigators had earlier asked the public to help identify a voice on a recording of a social engineering call used in that attack.

Why It Matters

ShinyHunters is one of the most active extortion crews of the past two years. The group is accused of breaching more than 140 organizations, including Ticketmaster, AT&T, Pornhub and Odido, and threatening to publish stolen data unless victims pay. FBI Assistant Director Brett Leatherman said the group has collected at least $70 million in extortion payments, CyberScoop reported.

The case became public days after ShinyHunters claimed to have breached the FBI's careers site and taken personal data on agents and applicants. SecurityWeek reported that the group allegedly used an Oracle PeopleSoft vulnerability, CVE-2026-35273, in that intrusion, and that the group's current leader, a Jordanian teenager nicknamed Ray, had reportedly attributed the FBI hack to van der Stap. ShinyHunters representatives told TechCrunch and BleepingComputer that the man has no connection to the group.

Background

Van der Stap was first arrested in January 2023 and charged with hacking and extorting more than a dozen companies in the Netherlands and abroad. He pleaded guilty and received a four-year sentence with one year suspended, followed by probation, according to BleepingComputer. SecurityWeek reported he had been working in offensive security while on supervised release, and had earlier been employed as a software engineer at security startup Hadrian.

What to Watch

Custody will run for at least 90 days as prosecutors build both cases, and police said more information would follow the hearing. FBI Director Kash Patel said U.S. teams are working with partners on further leads, and Leatherman warned the group's remaining members that "arrests have a way of changing who is willing to talk," according to CyberScoop.