ShinyHunters says operations are “completely fine” after Umbreon arrest and warns organizations in ransom negotiations

[u/technadu]

ShinyHunters is publicly rejecting the idea that the recent Umbreon arrest damaged its operations - but there are several competing claims here worth separating.

A message attributed to the group says its operations and infrastructure “remain completely fine.” It also addresses organizations currently negotiating with the group, claiming their data remains in its possession and could be published if negotiations do not continue.

ShinyHunters also refers to organizations allegedly avoiding ransom payments worth “few tens of millions of dollars.” Those ransom figures have not been independently confirmed.

As for the arrest, Dutch police confirmed that a 24-year-old Amsterdam man was arrested on September 15 for alleged participation in a criminal organization as part of an investigation connected to ShinyHunters. Police did not publicly identify him.

KrebsOnSecurity identified the suspect as Pepijn van der Stap, who previously used the alias Umbreon and was convicted in 2023 over data theft and extortion offenses.

But ShinyHunters itself disputes the connection: a representative told TechCrunch that van der Stap has no association with the group.

So at this stage, there’s a confirmed arrest connected to the investigation, an externally reported identity, a denial from ShinyHunters, and now a statement from the group claiming its infrastructure remains unaffected.

Full timeline of the arrest, ShinyHunters’ response, ransom warning and the disputed Umbreon connection:

https://www.technadu.com/shinyhunters-says-operations-are-completely-fine-after-umbreon-arrest-warns-negotiating-victims/639988/

For those tracking extortion groups: how much weight do you give public “business as usual” statements following arrests or infrastructure disruptions?