Dutch law enforcement officials have taken into custody a 24‑year‑old man from Amsterdam in connection with a high‑profile investigation into the hacking outfit known as ShinyHunters. According to the Federal Bureau of Investigation, this group was behind a major data breach that revealed the daily earnings of Rockstar Games' massively popular online service, GTA Online, earlier this year.
The arrest was first reported by Rockstar Intel and subsequently confirmed by the Dutch National Police in a statement released on September 28. While the police statement initially omitted the suspect's name, a later Reuters report identified him as Pepijn van der Stap.
Van der Stap holds the position of offensive cybersecurity lead at Neo Security, a firm based in Amsterdam that focuses on penetration testing and threat mitigation. Despite joining Neo Security only this year, he carries a criminal record that includes prior convictions for offenses related to unauthorized computer access. Federal investigators allege that van der Stap has been at the helm of ShinyHunters since 2025, a claim the group has publicly denied.
In their denial, ShinyHunters accused the Dutch police of mishandling the case and suggested that the authorities lacked the technical expertise to properly investigate such sophisticated cyber‑crime activities. ShinyHunters has earned a notorious reputation for targeting a wide array of organizations. Over the past few years, the group has been linked to more than one hundred intrusions spanning private corporations, public institutions, and even government agencies. Among the most high‑profile victims are Rockstar Games, the ticket‑selling giant Ticketmaster, and the FBI itself.
Their modus operandi typically involves breaching internal networks, exfiltrating sensitive data, and then demanding payment in exchange for not publishing the stolen information. In April, the group succeeded in infiltrating Rockstar's internal systems and attempted to extort the studio. They threatened to release confidential financial data unless Rockstar paid a ransom. The game developer refused to capitulate, opting instead to let the information become public.
As a result, the leaked documents disclosed that GTA Online generates more than one million US dollars in revenue each day, underscoring the massive profitability of the game's micro‑transaction model. The leak added to a string of recent security setbacks for Rockstar.
In August, another hacker collective known as CyberLeek leaked unauthorised gameplay footage of the highly anticipated GTA 6. That incident prompted Take‑Two Interactive, Rockstar's parent company, to issue subpoenas to major technology platforms—including Microsoft, Discord, and X (formerly Twitter)—in an effort to trace the origin of the leak and hold the responsible parties accountable. Following van der Stap's arrest, Brett Leatherman, the assistant director of the FBI's Cyber Division, issued a stark warning to any remaining members of ShinyHunters.
"Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not," Leatherman said in a public statement. "Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left.
The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." Leatherman's message is a clear indication that the FBI intends to continue its aggressive pursuit of the remaining operatives, leveraging both legal pressure and technical forensics to dismantle the group's infrastructure. The agency has previously demonstrated a willingness to seize servers, domain names, and cryptocurrency wallets associated with cyber‑crime groups, thereby cutting off the financial lifelines that sustain illicit operations.
The arrest also arrives at a turbulent time for Rockstar beyond the realm of cybersecurity. The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB). The dispute centers on the dismissal of 34 employees in October of the previous year, an action the union claims was retaliatory and linked to the staff's involvement in union‑organising activities.
The tribunal has drawn attention to broader concerns about labor practices within the video‑game industry, especially as companies grapple with the pressures of maintaining live‑service titles like GTA Online while managing large, often outsourced, workforces. Industry analysts suggest that the combination of cyber‑security breaches and labor disputes could have far‑reaching implications for Rockstar's reputation and its parent company's bottom line.
While the financial impact of the GTA Online revenue leak is difficult to quantify precisely—given that the disclosed figure of over $1 million per day already reflects a robust earnings stream—the public exposure of internal financial data may erode investor confidence and invite increased regulatory scrutiny. In response to the series of attacks, Rockstar has reportedly bolstered its internal security protocols, investing in advanced threat‑detection systems and expanding its cyber‑security team. The studio has also pledged to cooperate fully with law‑enforcement agencies worldwide to bring the perpetrators to justice and to safeguard player data moving forward.
The broader cyber‑crime landscape continues to evolve, with groups like ShinyHunters and CyberLeek illustrating how lucrative digital assets—whether they are in‑game currencies, proprietary code, or confidential financial reports—have become prime targets for sophisticated threat actors. As governments and private companies intensify their collaborative efforts to combat these threats, the arrest of a key figure such as Pepijn van der Stap may serve as a warning to other cyber‑criminals that law‑enforcement capabilities are catching up with the pace of technological exploitation.
Ultimately, the incident underscores the delicate balance that modern entertainment companies must strike between delivering engaging, revenue‑generating content and protecting the vast amounts of data that underpin their operations. For Rockstar, navigating the fallout from the GTA Online leak, the ongoing labor dispute, and the broader challenges of cyber‑security will require a coordinated strategy that addresses both technical vulnerabilities and the human factors that influence organizational resilience.