In a statement posted to social media site X, Dutch police said a 24-year-old man had been arrested in connection with the inquiry and would appear in court in Rotterdam on Tuesday.
The statement did not name the man. But Benjamin Korper of Amsterdam-based cybersecurity company Neo Security said it was Pepijn van der Stap, the company's offensive security lead.
In an interview with Reuters, Korper said Dutch forensic investigators visited his office on September 15, the night Van der Stap was arrested in a dramatic police raid that involved flash bang grenades.
The arrest comes amid escalating concern over ShinyHunters, a hacking group known for large-scale data breaches and extortion, and its recent theft of what it said was terabytes of sensitive personnel data from US FBI servers.
At least some of the data includes employees' intelligence assignments and medical records, Reuters has reported. Some compared this to the disastrous 2015 hack of the US Office of Personnel Management.
An internal memo said the FBI was operating under the presumption that hackers stole data pertaining to all bureau employees, according to a person briefed on the matter.
In a statement, ShinyHunters said Van der Stap had "no association" with the group and Dutch police were incompetent. The hackers said now they were not setting a deadline for the FBI to rescind an advisory about ShinyHunters, softening their initial statement which gave the FBI a week.
"This was not a threat," they said. "Nothing will happen."
News of Van der Stap's arrest, first reported by independent journalist Brian Krebs, caused a stir in the cybersecurity community.
Van der Stap's 2023 convictions of data theft and extortion had already received widespread publicity, as did his subsequent public disavowal of cybercrime. On his personal website, Van der Stap acknowledged his journey "hasn't been a straight line" but said his experience had taught him "knowledge is for building and protecting, not breaking."
Korper said he had carefully vetted Van der Stap before hiring him, monitored him during his employment, and was shocked by the arrest.
"I truly believe that people deserve a second chance, but in this case I was not thanked for it," Korper said. "Absolutely everybody I talked to is flabbergasted."
The executive said he had hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but so far investigators have found no evidence that he acted against his employer or its clients.
