[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHs2Au9azTByTdaXqz4gCJXSHEEPfK3769RmJZRpPsW0":3},{"article":4,"iocs":54,"watch_terms":64,"solutions":65,"lesson":68},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":36},"faa56092-8710-4ade-82fd-08b097969f4f","Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation","dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation-c919c2","Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p.","Dutch authorities have arrested Pepijn van der Stap, a convicted cybercriminal, on suspicion of aiding the ShinyHunters group. Following his arrest, ShinyHunters reportedly escalated attacks, stealing data from the FBI and extorting the Cl0p ransomware group. Van der Stap, previously convicted for data theft and extortion, had claimed to be reformed and was working in cybersecurity.","Dutch police arrest alleged ShinyHunters associate; group escalates attacks.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F09\u002Fdutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation\u002F",null,"2026-09-28T15:08:57+00:00","2026-09-28T18:00:14.673766+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Cl0p",{"name":23,"type":24},"Umbreon","product",{"name":26,"type":27},"Hadrian","vendor",{"name":29,"type":27},"Neo Security",{"name":31,"type":24},"Odido","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":12,"name":34,"slug":35},"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":12,"name":50,"slug":51},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":53},{"id":32,"icon":12,"name":34,"slug":35},[55,58,60],{"type":56,"value":18,"context":57},"malware","Prolific hacker group involved in data thefts and extortions.",{"type":56,"value":21,"context":59},"Russian ransomware group extorted by ShinyHunters.",{"type":61,"value":62,"context":63},"mitre_attack","T1566.002","Social engineering via spoofed website to gain access (Odido incident).",[26,29,23],{"controls":66,"vendors":67},[],[],{"slug":69,"title":70,"body":71,"framework_refs":72,"framework_notes":82},"convicted-hackers-cybersecurity-role-highlights-insider-threat-risks","Convicted Hacker's Cybersecurity Role Highlights Insider Threat Risks","Pepijn van der Stap, a previously convicted cybercriminal, was permitted to work in the cybersecurity industry despite a documented history of data theft and extortion — illustrating a critical failure in personnel vetting and access control. His alleged involvement with ShinyHunters demonstrates how insider threats can originate from individuals with privileged knowledge of security systems and methodologies. The subsequent escalation of attacks following his arrest — including data theft from the FBI and extortion of the Cl0p group — underscores how a single compromised actor can amplify broader criminal operations. This case highlights why trust must be continuously verified rather than assumed based on self-reported reform, particularly in roles that grant access to sensitive systems and intelligence.",[73,74,75,76,77,78,79,80,81],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 PS-3: Personnel Screening","NIST SP 800-53 IR-6: Incident Reporting","NIST Insider Threat Guide (SP 800-53 AT-2)","ISO\u002FIEC 27001:2022 A.6.1: Screening","GDPR Article 32: Security of Processing","ITIL Service Management: Access Management Process",{}]