Dutch law enforcement officials have taken into custody a 24‑year‑old man from Amsterdam as part of a broader probe into the activities of the notorious hacking outfit known as ShinyHunters. The group, which U.S. authorities allege was responsible for a high‑profile data breach earlier this year, leaked confidential financial data showing the daily revenue generated by Rockstar Games' massively popular online title, GTA Online.
The arrest was confirmed by the Dutch National Police in a press release issued on September 28. While the statement initially omitted the suspect's name, a later report from Reuters identified the individual as Pepijn van der Stap. Van der Stap holds the position of offensive cybersecurity lead at Neo Security, a firm based in Amsterdam that specializes in penetration testing and threat‑hunting services.
According to court records, he has a history of convictions related to hacking offenses, although he only joined Neo Security earlier in the current year. The FBI, however, maintains that van der Stap has been at the helm of ShinyHunters since 2025, a claim the group publicly denies, accusing Dutch police of incompetence and mishandling of the investigation. ShinyHunters has built a reputation for targeting a wide array of high‑profile victims. Over the past few years the collective is linked to successful intrusions at more than 100 corporations, governmental agencies, and entertainment companies, including Rockstar Games, Ticketmaster, and even the FBI itself.
Their modus operandi typically involves breaching internal networks, exfiltrating sensitive data, and then leveraging that information for financial gain through extortion or public disclosure. In April, the group infiltrated Rockstar's internal systems and attempted to extort the studio. They threatened to release a trove of confidential documents unless Rockstar paid a ransom.
The game developer refused to negotiate, opting instead to disclose the breach publicly. Despite Rockstar's stance, ShinyHunters went ahead and published the stolen data, which revealed that GTA Online—Rockstar's live-service component of Grand Theft Auto V—generates more than one million US dollars in revenue each day. This figure underscored the massive profitability of the game's micro‑transaction model and sparked a wave of media coverage, highlighting both the financial success of the title and the vulnerabilities in Rockstar's security posture.
The leak added to a string of recent security incidents that have plagued Rockstar and its parent company, Take‑Two Interactive. Earlier in August, a separate hacker collective known as CyberLeek leaked unreleased gameplay footage of the highly anticipated GTA 6. The leak prompted Take‑Two to issue subpoenas to major technology platforms—including Microsoft, Discord, and X (formerly Twitter)—in an effort to trace the source of the footage and hold the perpetrators accountable. Following van der Stap's arrest, Brett Leatherman, an assistant director in the FBI's Cyber Division, issued a stark warning to any remaining members of ShinyHunters.
"Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not," Leatherman said in a recorded statement. "Other groups believed anonymity, or their friends, would protect them, and they were wrong.
Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you.
I suggest you reach out first while the choice is still yours." Leatherman's message serves as both a deterrent and an invitation, implying that cooperation with law enforcement could mitigate potential charges for those still operating within the group. It also reflects a broader strategy employed by U.S. agencies to dismantle organized cybercrime networks by targeting key figures and applying pressure on lower‑level participants.
The arrest comes at a tumultuous time for Rockstar, which is simultaneously dealing with internal labor disputes. The studio is currently embroiled in an employment tribunal brought by the Independent Workers' Union of Great Britain (IWUGB). The union alleges that Rockstar unlawfully dismissed 34 employees in October of the previous year as retaliation for their involvement in union activities.
The legal battle adds another layer of complexity to Rockstar's public image, as the company navigates both external cyber threats and internal workforce challenges. Industry analysts note that the convergence of high‑profile data breaches and labor unrest could have far‑reaching implications for Rockstar's future operations. On one hand, the exposure of revenue figures provides competitors and regulators with insight into the profitability of live‑service models, potentially prompting increased scrutiny of micro‑transaction practices.
On the other hand, the ongoing dispute with the IWUGB may affect employee morale and could influence the company's ability to attract and retain talent, especially in an industry where skilled developers are in high demand. Cybersecurity experts also emphasize that the ShinyHunters incident underscores the importance of robust defensive measures for companies handling valuable digital assets. While Rockstar has reportedly taken steps to strengthen its security architecture following the breach—such as implementing multi‑factor authentication, conducting comprehensive security audits, and enhancing network segmentation—the incident illustrates that even well‑funded studios remain vulnerable to sophisticated adversaries.
In the broader context, the van der Stap arrest highlights the increasingly transnational nature of cybercrime investigations. Dutch authorities collaborated closely with U.S. agencies, sharing intelligence and coordinating operational efforts to apprehend a suspect whose alleged activities spanned multiple jurisdictions. This cooperation reflects a growing recognition among law‑enforcement bodies that cyber threats do not respect national borders and that effective countermeasures require a unified, international response.
As the investigation unfolds, the cybersecurity community will be watching closely to see whether further arrests follow and how ShinyHunters' remaining members respond to the FBI's ultimatum. For Rockstar, the focus remains on shoring up its defenses, managing the fallout from the revenue leak, and navigating the ongoing labor dispute—all while continuing to develop and support its flagship titles that generate billions in revenue worldwide.