Pepijn van der Stap
Pepijn van der Stap | |
|---|---|
| Born | August 2002 (age 24) |
| Other name | Umbreon |
| Website | pepijnvanderstap |
Pepijn van der Stap (born August 2002) is a Dutch convicted cybersecurity criminal. While employed as a software engineer at the Amsterdam cybersecurity firm Hadrian and volunteering as a researcher for the Dutch Institute for Vulnerability Disclosure (DIVD), he simultaneously orchestrated a criminal scheme involving the theft of data from millions of individuals and the extortion of companies for millions of euros.[1][2]
His case drew significant media attention for the stark contrast between his public "white hat" persona and his "black hat" activities. The Dutch Public Prosecution Service (OM) treated the case as a precedent-setting event, intended to serve as a clear warning to other cybercriminals.[3]
Career
[edit]Van der Stap worked as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. Following his arrest in January 2023, he was dismissed. Hadrian conducted an internal investigation and reported finding no evidence that he had misused his position or access for his criminal schemes.[4] DIVD commissioned a report by information security company Fox-IT which concluded that van der Stap had not misused his access to DIVD systems or data.[5]
Criminal proceedings
[edit]From August 2020 until his arrest, van der Stap's criminal group hacked corporate networks, stole vast quantities of data, and extorted the victims. Ransom demands often exceeded €100,000, with one victim paying €700,000.[6] According to police, data was often still sold even after a ransom was paid.[3]
Operating under aliases including "Umbreon," he used hacker forums like RaidForums to sell stolen data. The enterprise laundered between €1.5M and €2.7M, primarily through cryptocurrency.[6][7] A two-year police investigation, which began in March 2021, led to his arrest on 23 January 2023.[8]
At his trial in Amsterdam, van der Stap provided a near-full confession and expressed remorse. In an unusual move, he requested to remain in custody to continue psychological therapy. On 3 November 2023, he was sentenced to four years in prison (one suspended) and a three-year probationary period.[9] The court's sentence was lower than the six years demanded by the OM, citing his cooperation, youth, and psychological issues as mitigating factors.
The OM explicitly framed the case as a means to set a powerful example. Calling it "unique in nature and scope," prosecutors demanded a severe six-year sentence to send a "clear signal" to the cybercrime community.[3] The OM stated that such large-scale data theft and extortion undermine society and the digital economy, justifying a sentence intended as a significant deterrent for other young, technically skilled individuals tempted by cybercrime.
Van der Stap's lawyer argued his actions were not driven by greed but were a compulsive "escape" from personal trauma and PTSD. His history with law enforcement began at age 12, and a subsequent intervention through the "Hack_Right" offender program failed to prevent his re-offense.[2]
ShinyHunters
[edit]In the beginning of 2026 he was released from prison. Van der Stap was arrested again in mid-September 2026 by the Dienst Speciale Interventies (DSI), the elite tactical unit of the Dutch National Police. Police are investigating van der Stap over suspected involvement with the hackers collective ShinyHunters.[10][11]
On 29 September 2026, Dutch authorities announced that van der Stap was additionally suspected of attempting to solicit two contract killings abroad. Following forensic examination of data on his seized laptop, investigators discovered indications that he had ordered two assassinations, leading prosecutors to formally charge him with attempted incitement of two murders. On the same day, an investigating judge at the Rotterdam District Court ordered his pre-trial detention extended by 90 days.[11]
See also
[edit]References
[edit]- ↑ "From RaidForums to Reality: How a Dutch Cybersecurity Expert Ended Up Behind Bars". DataBreaches.net. 20 November 2023. Retrieved 23 June 2025.
- 1 2 Stokkouw, Marlies (3 November 2023). "Witte-hoedenhacker had een duister dubbelleven: 's nachts stal hij data van miljoenen mensen". de Volkskrant. Retrieved 23 June 2025.
- 1 2 3 "Unieke zaak van 21-jarige 'ethisch hacker': OM eist 6 jaar cel voor grootschalige bedrijfsdiefstal en afpersing". Public Prosecution Service (OM). 20 October 2023. Retrieved 23 June 2025.
- ↑ "Opgepakte hacker werkte bij Hadrian – Returnista snelste groeier van Europa". MT/Sprout. 2 March 2023. Retrieved 23 June 2025.
- ↑ "Hacker vergreep zich niet aan DIVD-informatie". Computable.nl. 22 September 2023. Retrieved 23 June 2025.
- 1 2 "Dutch hacker gets four-year prison term for extorting companies, money laundering". Techzine Global. 6 November 2023. Retrieved 23 June 2025.
- ↑ "Nederlandse hoofdverdachte van grootschalige hacking bekent grotendeels". AG Connect. 25 July 2023. Retrieved 23 June 2025.
- ↑ "Hacker jailed for extortion, selling stolen data on RaidForums". BleepingComputer. 3 November 2023. Retrieved 23 June 2025.
- ↑ "ECLI:NL:RBAMS:2023:6967, Rechtbank Amsterdam, 13/310426-21". de Rechtspraak (in Dutch). 3 November 2023. Retrieved 23 June 2025.
- ↑ Wassens, Rik (29 September 2026). "Vermeende ShinyHunter Pepijn van der S. ging al twee keer in de fout". NRC (in Netherlands Dutch). Retrieved 30 September 2026.
- 1 2 Quekel, Sebastiaan (29 September 2026). "Pepijn (24) verdacht van geven moordopdrachten, 'ShinyHunters-leider' met flitsgranaten overmeesterd". AD.nl (in Netherlands Dutch). Retrieved 30 September 2026.