Dutch Police Detain Former Convicted Hacker in ShinyHunters Probe of Massive Odido Data Leak

Police in the Netherlands announced the detention of Pepijn van der Stap, a hacker with a prior conviction, as part of a broader investigation into the ShinyHunters criminal network and its role in the recent Odido breach that compromised the personal information of millions of customers.

Van der Stap, who previously served time for computer‑related offenses, was identified by authorities as a key figure in the illicit activities of the ShinyHunters group. While the exact nature of his involvement in the Odido case has not been disclosed, investigators say his arrest is a pivotal development in unraveling the chain of actors responsible for the leak.

ShinyHunters, an online forum known for buying and selling data harvested from compromised systems, has been linked to a series of high‑profile breaches over the past few years. The collective typically markets stolen credentials, financial records, and other sensitive material to interested buyers, profiting from the chaos it creates. Law enforcement agencies across Europe have been tracking the group’s operations, but its decentralized structure has made prosecution challenging.

The Odido incident, reported earlier this year, exposed a trove of personal details—including names, contact information, and service usage data—affecting a substantial portion of the telecom provider’s subscriber base. The scale of the exposure sparked concern among privacy advocates and prompted calls for tighter security standards within the industry.

Van der Stap’s apprehension underscores a growing willingness among Dutch authorities to pursue cybercriminals beyond the borders of a single breach. The investigation is being coordinated with international partners, reflecting the transnational nature of data‑theft networks. Officials indicated that the arrest could lead to additional detentions as the probe expands to other members of ShinyHunters.

The case remains active, and prosecutors have not yet announced formal charges. If convicted, van der Stap could face a substantial sentence that would reflect both his prior record and the severity of the current allegations. Meanwhile, Odido has pledged to strengthen its security posture and to provide affected customers with support services, as regulators monitor the fallout from the breach.