Odido Hack Arrest: What Expats Need to Know About the ShinyHunters Suspect, Murder Allegations, and the Flink Lesson

Dutch police have arrested a 24-year-old Amsterdam man, Pepijn van der S., in connection with the massive Odido data breach that exposed the personal information of over 6.2 million Dutch customers earlier this year. But the case has taken an unexpected turn: authorities also suspect Van der S. of attempting to solicit two murders abroad, while the hacker collective ShinyHunters denies he was ever a member.

For internationals living in the Netherlands, the Odido hack remains one of the largest data breaches in recent memory. If you were an Odido customer in February 2026, your name, address, phone number, and possibly financial details may have been stolen. Police have been hunting the perpetrator ever since, and this arrest marks the first major breakthrough.

Who is Pepijn van der S.?

Van der S. was already a convicted cybercriminal before this arrest. In 2023, he received a four-year prison sentence for hacking companies, extortion, and money laundering. He was released on conditions earlier this year. According to court records, he previously worked at a cybersecurity firm during the day while carrying out attacks at night – a dual life that mirrors the classic hacker archetype.

The police arrested him on September 15, 2026, and then seized his laptop. On it, investigators discovered material related to two murders that were allegedly planned abroad. “There are indications that the suspect ordered those killings,” police stated. Van der S. is now also being held under full restrictions – meaning limited contact with the outside world – on suspicion of attempting to solicit murder. The police stress this is a separate investigation from the Odido hack.

ShinyHunters: “He has nothing to do with us”

ShinyHunters, the hacker collective that claimed responsibility for the Odido breach, has publicly disavowed Van der S. “That person has nothing to do with us,” they told BNR on September 29. This contradicts earlier claims by the group that they had a lawyer ready for “their member” after police released an audio clip of the hacker on the TV program Opsporing Verzocht.

So who is the real ShinyHunters member? The police played a recording of the hacker speaking Dutch, using IT jargon, as he socially engineered an Odido employee into revealing login credentials. The voice analysis confirmed the call was human-made, not AI-generated. ShinyHunters initially acknowledged that the suspect in the audio was part of their group, but now they deny Van der S. is that person. This raises the possibility that another hacker is still at large, or that Van der S. acted independently while ShinyHunters sought to distance themselves.

What this means for people on residence permits

If you were a victim of the Odido breach, the practical risks remain: identity theft, phishing attempts, and fraud. For expats, a stolen passport number or DigiD credentials could complicate applications for residence permits, tax benefits (toeslagen), or registration with the gemeente. The government’s advice is unchanged: change passwords, enable two-factor authentication, and be alert for suspicious emails. You can also report identity fraud to the police and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

But there is a broader lesson from a related incident: the Flink extortion case. In late September, hackers demanded €10–15 per customer from the grocery delivery service’s data breach. They threatened to publish the stolen information on the dark web if victims did not pay. Nobody paid. The hackers had hoped to collect €200,000, but consumer psychologist Patrick Wessels noted to NOS that “people see data breaches come up constantly, but they rarely suffer any direct harm themselves.” Desensitization might be a double-edged sword, but in this case, ignoring the extortion worked – no payment, and no public leak has been reported yet.

The police investigation continues

The Dutch police say further arrests are not ruled out. They are still asking anyone who recognizes the voice from the Opsporing Verzocht clip to come forward. For now, Van der S. remains in custody, and the murder conspiracy allegations add a chilling dimension to a case that started with a simple phone call to Odido’s help desk.

For international residents, the key takeaway is that Dutch authorities are actively pursuing these cybercriminals, but the scale of the breaches means you cannot let your guard down. Check your digital footprint, and if you have been affected, act on the official advice from the government’s digital trust center (Fraude Helpdesk).

---

Sources: NOS on Opsporing Verzocht audio, NL Times on ShinyHunters lawyer, NOS on arrest, NL Times on ShinyHunters denial, NL Times on murder conspiracy, NL Times on Flink extortion