Pepijn van der Stap

Pepijn van der Stap (born 2002) is a Dutch cybersecurity specialist and convicted criminal. While employed as a software engineer at the Amsterdam cybersecurity firm Hadrian and volunteering as a researcher for the Dutch Institute for Vulnerability Disclosure (DIVD), he simultaneously orchestrated a criminal scheme involving the theft of data from millions of individuals and the extortion of companies for millions of euros.

His case drew significant media attention for the stark contrast between his public "white hat" persona and his "black hat" activities. The Dutch Public Prosecution Service (OM) treated the case as a precedent-setting event, intended to serve as a clear warning to other cybercriminals.

Career Van der Stap worked as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. Following his arrest in January 2023, he was dismissed. Hadrian conducted an internal investigation and reported finding no evidence that he had misused his position or access for his criminal schemes.

Concurrently, he was a valued volunteer researcher at the Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit group of ethical hackers. He served as case lead on several major vulnerability disclosures. After his arrest, an independent forensic investigation by Fox-IT, commissioned by DIVD, concluded that van der Stap had not misused his access to DIVD systems or data.

Criminal proceedings

From August 2020 until his arrest, van der Stap's criminal group hacked corporate networks, stole vast quantities of data, and extorted the victims. Ransom demands often exceeded €100,000, with one victim paying €700,000. According to police, data was often still sold even after a ransom was paid. A two-year police investigation, which began in March 2021, led to his arrest on January 23, 2023.

At his trial in Amsterdam, van der Stap provided a near-full confession and expressed remorse. In an unusual move, he requested to remain in custody to continue psychological therapy. On November 3, 2023, he was sentenced to four years in prison (one suspended) and a three-year probationary period. The court's sentence was lower than the six years demanded by the prosecution, citing his cooperation, youth, and psychological issues as mitigating factors.

The Public Prosecution Service (OM) explicitly framed the case as a means to set a powerful example. Calling it "unique in nature and scope," prosecutors demanded a severe six-year sentence to send a "clear signal" to the cybercrime community. The OM stated that such large-scale data theft and extortion undermine society and the digital economy, justifying a sentence intended as a significant deterrent for other young, technically skilled individuals tempted by cybercrime.

Van der Stap's lawyer argued his actions were not driven by greed but were a compulsive "escape" from personal trauma and PTSD. His history with law enforcement began at age 12, and a subsequent intervention through the "Hack_Right" offender program failed to prevent his re-offense.