Pepijn van der Stap worked as a software engineer at the Amsterdam cybersecurity startup Hadrian and volunteered as a researcher for the Dutch Institute for Vulnerability Disclosure (DIVD) while, under the hacker handle "Umbreon," he simultaneously hacked corporate networks, stole data, and extorted victims from August 2020 until his arrest. He sold stolen data on forums including RaidForums, with ransom demands often exceeding €100,000 (one victim paid €700,000), and the scheme laundered an estimated €1.5 million to €2.7 million, mostly through cryptocurrency. Both Hadrian and DIVD later conducted internal investigations and said they found no evidence he had misused his access at either organization for the scheme.
A two-year Dutch police investigation led to his arrest on January 23, 2023. At trial, van der Stap gave a near-full confession, and his lawyer argued his conduct stemmed from a compulsive need to collect data rather than greed, tied to childhood trauma and PTSD; he asked to remain in custody to continue psychological treatment. On November 3, 2023, an Amsterdam court sentenced him to 4 years in prison (one year suspended) and 3 years of probation -- less than the 6 years prosecutors had sought, who had called the case "unique in nature and scope" and wanted it to serve as a deterrent to other technically skilled young people.
Van der Stap was released from prison in December 2025 and went on to become offensive security lead at the Dutch firm Neo Security, telling Krebs on Security on September 9, 2026, that he was a reformed hacker trying to make amends. On September 15, 2026, Dutch police -- including the elite tactical unit Dienst Speciale Interventies -- arrested him again, this time in connection with an investigation into the hacking group ShinyHunters, which days later claimed a high-profile breach of the FBI's jobs website. Dutch authorities said forensic examination of his seized laptop also turned up evidence that he had attempted to solicit two contract killings abroad, and he was formally charged with attempted incitement of two murders in a separate case; a Rotterdam court extended his pretrial detention by 90 days on September 29, 2026. Neo Security's Benjamin Korper said he was "flabbergasted" by the arrest, and ShinyHunters itself publicly denied van der Stap had any association with the group.
