A 21-year-old man from Zandvoort was sentenced by the Amsterdam court to a four-year prison term, with one year suspended. According to the court, he was guilty of, among other things, computer breaking, extortion, fencing of non-public data and money laundering. The defendant must also pay damages of nearly three tons. This is stated in the verdict pronounced today by the Amsterdam District Court.
The case revolves around Pepijn van der S. Since early 2021, he and a number of accomplices allegedly hacked and extorted several Dutch companies, including RDC and Ticketcounter. The suspect stole personal and privacy-sensitive data of millions of Dutch citizens and threatened to sell this information via the dark web to the highest bidder. To prevent this, one of the victims paid nearly 750,000 euros.
The 21-year-old suspect worked during the day at cybersecurity firm Hadrian. He also volunteered at the Dutch Institute for Vulnerability Disclosure (DIVD), an organization that scours the Internet for vulnerabilities and warns companies about them. At night, he made victims by breaking in, stealing confidential and privacy-sensitive data and demanding ransoms. "White hat by day, black hat by night," is how the prosecutor described his modus operandi and behavior during the substantive hearing.
The Openbaar Ministerie called the case "unique on all fronts": not before has a case where the nature and scale was so great come before the court. "The trust in e-mail, on Internet banking or people who call you from an organization like the bank, has been seriously damaged as a result, while at the same time in this digitized world we are dependent on these very means," the prosecutor said. Because of the seriousness of his actions and to deter other hackers, the Openbaar Ministerie asked for a six-year prison sentence.
The District Court of Amsterdam finds it legally and convincingly proven that Pepijn van der S. is guilty of computer hacking, extortion, extortion, receiving non-public data, data theft and habitual money laundering. Extortion is a form of extortion in which the perpetrator does not threaten with violence, but uses another means of pressure (in this case private data). Habitual money laundering occurs when someone knowingly launders illegally obtained money and makes a habit of doing so.
"Through his actions, defendant caused several companies to become victims and his actions resulted in great financial damage for these companies. In making the threats and extortions, the defendant threatened to disclose confidential information of these companies which -in addition to financial damage- also threatened them with reputational damage," the court wrote in the verdict.
The judge blames the man from Zandvoort for using his knowledge of the digital world to steal confidential data and blackmail companies for nearly three years.
All things considered, the Amsterdam court determined that a sentence of four years' imprisonment, including one year's probation and a three-year probationary period, was appropriate for the defendant. In determining the sentence, the court took into account the man's personal circumstances, his young age, the fact that the man actively cooperated in the investigation and largely confessed to guilt.
While on probation, the defendant must abide by a number of special conditions. These include reporting to Reclassering Nederland, doing his best to find and keep paid work, and making payment arrangements to pay off his debts.
Several companies filed claims for damages with the court. Most of the claims were declared admissible by the court. That means the defendant must pay nearly three tons in damages to the victims. Litigation costs are in addition to that amount.
