Former ShinyHunters hacker arrested in what could be an elaborate frame job in FBI hack

A “former” member of ShinyHunters is arrested (again) by Dutch authorities just days after the extortion gang claims a massive hack of the FBI – but insiders say it could all be part of an elaborate setup by the alt spinoff “Scattered Lapsus$ Hunters” and its so-called leader to gain control over the group’s branding.

ShinyHunters, however, denied any connection to van der Stap in a statement to Cybernews Monday.

"That individual has no association with us. Frankly, we are laughing," the group said, calling Dutch police "unskilled and incompetent."

Dutch police are chasing attention and public favour after the massive embarrassment in result of the Odido hack. They want to seem like they are ahead of the FBI in investigating ShinyHunters,

ShinyHunters further claimed to Cybernews.

Odido hack leads to ShinyHunters arrest

The arrest took place around September 16th, according to a new report published Monday by Brian Krebs, who identified the hacker as 23-year-old Pepijn van der Stap from the Almere/Lelystad area near Amsterdam.

Van der Stap is currently being held for questioning as of Monday in connection with the February hack of Odido, the Netherlands’ largest telecommunications company.

ShinyHunters, which reportedly breached the telecom provider through a sophisticated IT help desk social engineering attack, made off with the sensitive data of 6.2 million Odido customers – including bank account numbers and government IDs – publishing the massive cache on its dark leak site days later.

The nation's cybercrime division was able to obtain a recording of the ShinyHunters phone call used to target Odido employees, identifying the caller as a Dutch-speaking man.

Authorities have not publicly confirmed whether van der Stap is the Dutch-speaking man heard on the recording.

An elaborate ShinyHunters frame job?

What makes the timing of the arrest a bit more than coincidental is that van der Stap is no stranger to Dutch authorities.

The self-admitted ShinyHunters hacker was previously arrested in January 2023 and later sentenced to four years in prison – one year suspended – for his role in multiple ShinyHunters-claimed breaches over the years, raking in more than $1.5 million dollars in ransom.

Released from prison in December 2025, van der Stap claims he has reformed from his Jekyll-and-Hyde cybercriminal life as a member of the prolific gang, working as an offensive security lead at the Dutch company Neo Security.

Meanwhile, Krebs reported Monday that sources familiar with the investigation believe the FBI hack may have been part of an attempt by a rival ShinyHunters faction to frame van der Stap, whose former online alias was "Umbreon," a popular Pokémon character.

ShinyHunters used the “Umbreon imagery” during its September 18–19 attack on rival ransomware gang Cl0p, as well as the targeted attack against the FBI on September 22nd – both taking place just days after van der Stap was arrested and before news of his arrest became public.

According to Krebs, van der Stap has since become embroiled in a dispute with "Rey" – the alleged mastermind behind the Scattered Lapsus$ Hunters spinoff – all over control of the ShinyHunters name and branding.

Sources cited by Krebs claim the rival faction may have deliberately used van der Stap's former "Umbreon" hacker identity to implicate him.

Cybernews has reached out to ShinyHunters for comment on the allegations and is awaiting a response at the time of publication.