Amsterdam man arrested over links to ShinyHunters hacking group

A 24-year-old man from Amsterdam has been arrested on suspicion of involvement with the hacking group ShinyHunters, which has been behind a number of large-scale attacks on Dutch businesses in the past year.

Police said on social media that he was arrested this month and will appear in court in Rotterdam on Wednesday.

Sources told broadcaster NOS that the suspect is Pepijn van der S., who was sentenced to four years in prison in 2023 for extortion, money laundering and hacking. He was released this year.

Van der S. reportedly has a background in legitimate cybersecurity, having worked for Amsterdam-based security firm Hadrian. He also carried out ethical hacking research with the Dutch Institute for Vulnerability Disclosure. At the same time, he was leaking data stolen from clients and other companies, the court found in 2023.

ShinyHunters was responsible for an attack on Dutch telecoms provider Odido earlier this year, in which millions of customers had their personal data stolen. After the company refused to pay a ransom, the group posted much of the data on the dark web.

The hackers were also behind an attack on Canvas, an online learning platform used by students, after which its parent company paid a ransom to prevent further disruption.

Last week, ShinyHunters also claimed to have accessed the details of thousands of employees at the FBI, the US federal law enforcement agency. The FBI said an investigation was underway.