Dutch law enforcement officials have taken into custody a 24‑year‑old resident of Amsterdam in connection with a sprawling investigation into the cyber‑crime outfit known as ShinyHunters. The group, which U.S. federal investigators have linked to a high‑profile data breach earlier this year, allegedly exposed internal financial records that showed just how much money Rockstar Games’ online service, GTA Online, pulls in on a daily basis. The arrest was confirmed by the Dutch National Police in a press release dated September 28, although the statement initially omitted the suspect’s name.
Media outlet Reuters later identified the individual as Pepijn van der Stap, who at the time of his detention served as the offensive cybersecurity lead for Neo Security, a boutique security firm based in Amsterdam. Van der Stap’s professional résumé includes a series of past convictions for offenses related to unauthorized computer access, and he reportedly joined Neo Security only this year despite allegations from the FBI that he has been steering ShinyHunters since 2025. ShinyHunters, a loosely organized network of hackers, has been tied to more than a hundred intrusions targeting a wide array of companies and public institutions.
Among its alleged victims are Rockstar Games, the ticket‑selling giant Ticketmaster, and even the Federal Bureau of Investigation itself. The group’s activities have drawn significant attention after a series of high‑impact attacks that have not only resulted in the theft of sensitive data but also in attempts to extort the affected organizations. In April, ShinyHunters breached Rockstar’s internal systems and demanded a ransom, threatening to publish the stolen information if their demands were not met.
When Rockstar refused to negotiate, the hackers followed through on their threat, releasing a cache of confidential documents that revealed GTA Online’s revenue exceeds one million dollars per day. This disclosure provided a rare glimpse into the financial engine behind one of the world’s most successful live‑service games, underscoring the lucrative nature of the platform and the stakes involved for both the company and the cyber‑criminals targeting it. The leak added to a string of security challenges that Rockstar has faced in recent months. In August, a separate hacker collective known as CyberLeek leaked unreleased gameplay footage from the highly anticipated GTA 6, prompting Take‑Two Interactive, Rockstar’s parent company, to issue subpoenas to major technology platforms including Microsoft, Discord, and X (formerly Twitter) in an effort to trace the source of the breach.
These incidents have forced Rockstar’s security team to confront a multi‑front assault on its digital assets, ranging from financial data theft to the premature exposure of unreleased content. Following the recent arrest, Brett Leatherman, an assistant director with the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters. In a public statement he said, “Now, to the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague.
We are confident you have seen or heard things in recent days that the public has not. Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you.
You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.” Leatherman’s message is a clear indication that U.S.
authorities are intensifying their efforts to dismantle the network and encourage insiders to cooperate. By highlighting the inevitability of detection and the potential consequences of continued involvement, the FBI hopes to erode the group’s cohesion and extract actionable intelligence that could lead to further arrests. The arrest also arrives amid ongoing labor disputes involving Rockstar.
The studio is currently embroiled in an employment tribunal with the Independent Workers’ Union of Great Britain, which is representing 34 former employees who were dismissed in October of the previous year. The claimants allege that their termination was retaliatory, stemming from their involvement in union activities.
While this legal battle is separate from the cyber‑security issues, it adds another layer of public scrutiny to Rockstar’s corporate practices and internal culture. Experts suggest that the convergence of cyber‑attacks and labor unrest may signal a broader trend of heightened vulnerability for large entertainment companies. As studios increasingly rely on digital distribution, live‑service models, and online communities, they become attractive targets for both financially motivated hackers and activists seeking to expose perceived corporate misconduct.
In response to the mounting pressure, Rockstar has reportedly bolstered its security infrastructure, investing in advanced threat detection tools and expanding its internal security team. The company has also pledged greater transparency with its player base, emphasizing that it will continue to protect user data and safeguard the integrity of its games.
The case of Pepijn van der Stap and ShinyHunters serves as a reminder that cyber‑crime operations are often spearheaded by individuals with formal technical training who can blend legitimate employment with illicit activities. Law enforcement agencies worldwide are sharpening their focus on such hybrid actors, employing a mix of traditional investigative techniques and cutting‑edge digital forensics to track down perpetrators. As the investigation unfolds, the broader gaming community watches closely. The revelations about GTA Online’s daily earnings have sparked discussions about the economics of free‑to‑play models, microtransactions, and the ethical considerations of monetizing virtual worlds.
Meanwhile, the legal proceedings surrounding Rockstar’s labor dispute may set precedents for how entertainment companies handle employee relations in an era of heightened activism. Overall, the arrest marks a significant development in the ongoing battle between cyber‑criminals and the companies they target. It underscores the importance of robust cybersecurity measures, the potential ramifications of data leaks for corporate reputation and financial performance, and the intricate interplay between technology, law enforcement, and corporate governance in today’s digital landscape.