Dutch law enforcement officials have taken a 24‑year‑old man from Amsterdam into custody as part of a broader probe into the activities of the notorious hacking outfit known as ShinyHunters. The group, which U.S.
authorities allege was responsible for a high‑profile data breach earlier this year, managed to obtain and publicise internal financial figures for Rockstar Games' massively popular online service, GTA Online. The arrest was first reported by Rockstar Intel, a community‑run news source that frequently aggregates information about the developer, and subsequently confirmed by the Dutch National Police in a statement released on September 28. While the police statement omitted the suspect's name, a later Reuters report identified him as Pepijn van der Stap. Van der Stap is employed as the offensive cybersecurity lead at Neo Security, a security consultancy based in Amsterdam, a position he only assumed earlier in the year.
According to the FBI, however, he has been at the helm of ShinyHunters since 2025, a claim that the group has publicly refuted, accusing the Dutch authorities of mishandling the investigation. Van der Stap's criminal record includes several prior convictions for offenses related to unauthorized computer access, which raises questions about how he was able to secure a senior role at a reputable security firm despite his history.
The FBI’s involvement in the case underscores the transnational nature of the investigation, as ShinyHunters has been linked to more than a hundred breaches targeting a wide array of organisations, ranging from entertainment giants like Rockstar Games to ticketing platform Ticketmaster, and even the Federal Bureau of Investigation itself. In April, ShinyHunters infiltrated Rockstar's internal networks and attempted to extort the studio by threatening to release confidential data unless a ransom was paid. Rockstar declined to negotiate, and the hackers went ahead with the publication of the stolen information.
Among the leaked data was a striking revelation: GTA Online, the persistent online component of Grand Theft Auto V, was generating in excess of one million US dollars in revenue each day. This figure not only highlighted the massive profitability of the game's live‑service model but also provided a rare glimpse into the financial performance of a major video‑game franchise, information that is typically guarded closely by corporate executives. The leak added to a string of security challenges that Rockstar has faced over the past months. In August, a separate hacker collective known as CyberLeek released unauthorised gameplay footage from the highly anticipated GTA 6, prompting Take‑Two Interactive, Rockstar’s parent company, to issue subpoenas to major tech platforms including Microsoft, Discord, and X (formerly Twitter).
The subpoenas were intended to gather information that could help identify the individuals behind the leak and to mitigate further unauthorised disclosures. Following the recent arrest, Brett Leatherman, an assistant director in the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters.
In a public statement, he said: "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not.
Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left.
The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." Leatherman's message is a classic example of law‑enforcement leveraging a high‑profile arrest to pressure remaining conspirators into cooperation, often by suggesting that the net is closing around them and that the benefits of surrender may outweigh the risks of continued illicit activity.
Such tactics have been employed in numerous cybercrime investigations worldwide, where dismantling a network often depends on turning insiders into informants. Beyond the immediate legal ramifications, the incident has broader implications for the video‑game industry’s approach to cybersecurity. The exposure of daily revenue figures not only reveals the financial stakes involved but also underscores the vulnerabilities inherent in complex, globally distributed development pipelines.
Companies like Rockstar must now reassess their security architectures, employee training programs, and incident‑response strategies to guard against both external attacks and insider threats. The arrest also arrives amid an ongoing employment dispute at Rockstar.
The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB) over the dismissal of 34 employees in October of the previous year. The claimants allege that their termination was retaliatory, linked to their involvement in union activities. This legal battle adds another layer of public scrutiny to Rockstar, as the company navigates both internal labour relations challenges and external cyber‑security threats. In summary, the apprehension of Pepijn van der Stap marks a significant development in the fight against organized cyber‑crime groups targeting high‑value entertainment assets.
While ShinyHunters continues to deny leadership involvement and criticise the competence of Dutch police, the combination of international law‑enforcement pressure and the potential for further disclosures keeps the group under intense observation. For Rockstar and its parent company, Take‑Two, the episode serves as a reminder of the critical importance of robust cyber‑defences, proactive threat hunting, and swift, decisive action when breaches occur. The broader industry will be watching closely to see how these lessons are applied in future security strategies, especially as the financial stakes of live‑service games continue to rise.