Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders

Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far.

A 24-year-old Dutch national who previously served time for hacking-related crimes was back in a Dutch court this morning. And while people familiar with the man’s history and allegations that he was involved in ShinyHunters expected to hear charges related to ShinyHunters or specific breaches, what they heard was that the man was charged with attempted incitement to two murders.

The Dutch Politie reported, in part, on the developments and hearing in the Rotterdam District Court this morning:

On Tuesday, September 15, the police arrested a 24-year-old man from Amsterdam who is suspected of playing a role within the hacker group ShinyHunters. The man is also suspected of attempted incitement to commit two murders. Various data carriers have been seized and are being investigated further. Further arrests are not ruled out.

The suspect came into the picture during an investigation by the National Investigation and Intervention Unit. The High Tech Crime Team is investigating ShinyHunters under the authority of the National Public Prosecutor’s Office. ShinyHunters is a criminal hacker and extortion group that has been involved in many major data breaches, such as those of Odido, Pornhub, and TicketMaster.

The Amsterdam resident is suspected of participating in a criminal organization and has been arrested for that reason. Following his arrest on September 15, a large amount of information was found on his laptop, including details about two murders that were to be committed abroad. There are indications that the suspect gave the order for this. Therefore, the man is also suspected of attempted incitement to commit two murders. That suspicion is separate from the investigation into ShinyHunters. The suspect is being held in complete isolation, and the police are conducting a thorough investigation into the allegations.

So the original arrest on September 15 was not because they had any knowledge or indication of any attempted incitement. They just found it on his laptop. No charges were filed today about involvement in any specific ShinyHunters activities, and we note that the Dutch announcement says the man is “suspected of playing a role” within ShinyHunters. They do not allege that he is a leader of ShinyHunters.

The FBI, on the other hand, characterizes him as an alleged leader of ShinyHunters in their statement on X.com today:

Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world. The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That’s exactly how the “best athlete” model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads.

The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.

DataBreaches does not know why the FBI characterizes him as an “alleged leader.” Perhaps more will be revealed later to clarify what van der Stap’s alleged connection to ShinyHunters was.

The attempted incitement to murder charges

DataBreaches has previously commented somewhat negatively on recent other coverage of van der Stap and the case against him, suggesting we all wait to see what the charges related to ShinyHunters actually are.  We will still have to wait for those. For now, here’s what we know about the attempted incitement to murder. We’ll do this as an FAQ for simplicity’s sake:

Q. Did DataBreaches know about any alleged incitement to murder prior to van der Stap’s arrest?

A.  No.

Q. Does DataBreaches know who the intended targets of the alleged plans were?

A. We have been told two names by a source with some knowledge of the matter.

Q. Is there any evidence that the alleged plans resulted in murder?

A. No, which is consistent with charges of attempted incitement and not homicide. We also note that Dutch police say they found “indications” that he gave the orders. As worded, that doesn’t sound like concrete evidence.

Q. An online post suggested this was related to a November 2025 chat or exchange about planning hits on researchers. Was the November 25 report connected to these charges?

A. Not as far as I know. According to a source familiar with the matter, the alleged plots are recent. I also note that the November 2025 material did not appear to involve van der Stap at all by name or reference, and appeared more likely to be written by “Rey.”

Q. What did DataBreaches do when you learned of the alleged plans?

A. In case the allegations were true, I reached out to people whom I felt might have contacts and the ability to cancel any “hits.”

Q.  Did they?

A.  As far as I know, yes.

Q. Why won’t you say who the alleged targets were?

A. Because I think the Dutch police should contact them if they have actual evidence.

Q. Will you say who you contacted to try to thwart any plots?

A. No.

Q. You have reported on van der Stap many times over the past few years. Were you surprised to hear about the alleged plots?

A. Yes. This just seems totally inconsistent with the person I’ve known. And I know from all the messages I have received today that many other people are also shocked and devastated by these charges.  If the allegations are true, I hope a qualified psychiatrist can evaluate whether he was in the throes of any extreme anxiety or paranoia at the time, because he does have a history of acute anxiety and paranoia that I have reported on in the past.