Dutch law enforcement officials have apprehended a 24‑year‑old man from Amsterdam as part of a broader probe into the activities of the notorious hacking outfit known as ShinyHunters. The group, which U.S.
authorities allege was responsible for a high‑profile data breach earlier this year, allegedly leaked confidential financial figures that showed just how much revenue the online component of Grand Theft Auto (GTA Online) generates on a daily basis. The arrest was first hinted at by the investigative site Rockstar Intel, which cited a Kotaku report that the Dutch National Police had taken a suspect into custody on September 28.
While the police statement at the time omitted the individual’s name, a later Reuters article identified him as Pepijn van der Stap. Van der Stap is employed as the offensive cybersecurity lead at Neo Security, a firm based in Amsterdam. According to public records, he has a history of convictions related to hacking, and he only joined Neo Security earlier this year.
The FBI, however, maintains that van der Stap has been steering ShinyHunters since 2025, a claim that the group itself disputes, accusing Dutch authorities of mishandling the investigation. ShinyHunters has earned a reputation for breaching a wide array of targets—more than one hundred companies and institutions have reportedly been compromised. Among the most high‑profile victims are Rockstar Games, the ticket‑selling giant Ticketmaster, and even the FBI’s own networks. In April, the group infiltrated Rockstar’s internal systems and attempted to extort the studio by threatening to publish stolen confidential data unless a ransom was paid.
Rockstar refused to negotiate, but ShinyHunters went ahead and released the information anyway. The leak disclosed that GTA Online, the persistent online mode of Grand Theft Auto V, pulls in excess of one million U.S.
dollars each day, a figure that underscores the massive financial stakes involved in modern video‑game ecosystems. The incident added another layer of difficulty for Rockstar’s security team, which was already grappling with a separate leak in August. That earlier breach involved the hacker collective CyberLeek, which managed to obtain and disseminate gameplay footage from the highly anticipated GTA 6. In response, Take‑Two Interactive, Rockstar’s parent company, issued subpoenas to major tech platforms—including Microsoft, Discord, and X (formerly Twitter)—in an effort to trace the individuals responsible for the unauthorized distribution.
Following van der Stap’s detention, Brett Leatherman, an assistant director with the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters. He addressed the group directly, stating, "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not." He continued, "Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left.
The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." Leatherman’s message is part of a broader strategy employed by law‑enforcement agencies to destabilize organized cybercrime groups by sowing distrust and encouraging defections. By publicizing the arrest and directly appealing to potential informants, the FBI hopes to fracture ShinyHunters and gain access to the technical infrastructure that the group relies upon for its operations.
The arrest also occurs against the backdrop of ongoing labor disputes at Rockstar. The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB).
The union alleges that Rockstar unlawfully dismissed 34 employees in October of the previous year as retaliation for their involvement in union activities. This legal battle adds another dimension to Rockstar’s challenges, as the company must navigate both cybersecurity threats and internal labor relations simultaneously.
In summary, the detention of Pepijn van der Stap marks a significant development in the international effort to curb the activities of ShinyHunters. The group’s history of high‑profile intrusions, ranging from ticket‑sales platforms to the FBI itself, has placed it squarely in the crosshairs of multiple law‑enforcement agencies. The leaked financial data on GTA Online’s daily earnings not only highlighted the lucrative nature of modern online gaming services but also underscored the potential damage that can result when such sensitive information falls into the hands of malicious actors.
As the FBI continues its campaign to dismantle the network, the broader gaming industry watches closely, aware that the stakes—both financial and reputational—are higher than ever.