Dutch law enforcement officials have taken into custody a 24‑year‑old man from Amsterdam as part of a broader probe into the notorious hacking outfit known as ShinyHunters. The group, which U.S. federal investigators have linked to a high‑profile data breach earlier this year, allegedly leaked internal financial figures for Rockstar Games' massively popular online title, GTA Online. The leaked documents revealed that the game generates more than one million dollars in revenue each day, a staggering sum that underscored the lucrative nature of the live‑service model.
The arrest was confirmed by the Dutch National Police in a statement released on September 28. While the police initially withheld the suspect's identity, a later report from Reuters identified him as Pepijn van der Stap. Van der Stap is employed as the offensive cybersecurity lead at Neo Security, a boutique security firm based in Amsterdam. According to public records, he joined Neo Security earlier this year, but his criminal history includes prior convictions for hacking‑related offenses.
Federal investigators in the United States allege that van der Stap has been at the helm of ShinyHunters since 2025, a claim the group itself has publicly denied, accusing Dutch authorities of mishandling the investigation. ShinyHunters has earned a reputation for targeting a wide array of high‑profile organizations.
Over the past few years the collective has been linked to intrusions at more than one hundred companies and institutions, ranging from entertainment giants like Rockstar Games to ticket‑selling platforms such as Ticketmaster, and even to the FBI itself. In April, the group breached Rockstar’s internal systems and attempted to extort the studio. Their demand was simple: pay up or face the public release of confidential data. Rockstar refused to acquiesce, and the hackers followed through on their threat, publishing the stolen files.
Among the leaked material were internal spreadsheets that detailed GTA Online’s daily revenue, confirming that the game was pulling in excess of $1 million per day. The incident added another layer of difficulty for Rockstar’s security team, which had already been dealing with a separate leak in August.
That earlier breach involved the hacker collective known as CyberLeek, which managed to obtain and disseminate unauthorised gameplay footage from the yet‑to‑be‑released GTA 6. The leak prompted Take‑Two Interactive, Rockstar’s parent company, to issue subpoenas to major technology platforms—including Microsoft, Discord, and Twitter (now X)—in an effort to trace the source of the footage and hold the perpetrators accountable.
Following van der Stap’s arrest, Brett Leatherman, an assistant director in the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters. In a recorded statement, Leatherman said, "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not. Other groups believed anonymity, or their friends, would protect them, and they were wrong.
Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you.
I suggest you reach out first while the choice is still yours." This message was clearly intended to pressure any still‑active participants into surrendering or cooperating with investigators, emphasizing that law‑enforcement agencies are closing in and that the net is tightening around the remaining operatives. The fallout from the GTA Online revenue leak is not limited to financial embarrassment. It also has legal and labor‑relations ramifications for Rockstar.
The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB). The dispute stems from the dismissal of 34 employees in October of the previous year, an action the union alleges was retaliatory—punishing staff for their involvement in union‑organising activities. The tribunal, which is still ongoing, adds another pressure point for Rockstar as it navigates both external cyber threats and internal workforce challenges.
Cybersecurity experts point out that the ShinyHunters case illustrates a broader trend in cybercrime: the shift from purely financial theft to the strategic release of sensitive corporate data as a form of leverage. By exposing revenue figures, the hackers not only caused reputational damage but also potentially affected market perceptions, stock valuations, and competitive dynamics within the gaming industry. For a company like Take‑Two, whose earnings are closely watched by investors, the public disclosure of daily earnings can create volatility that extends far beyond the immediate breach.
In response to the incident, Rockstar has reportedly bolstered its internal security protocols, increased monitoring of privileged accounts, and engaged third‑party security firms to conduct comprehensive audits of its network infrastructure. The company has also reiterated its commitment to protecting player data and maintaining the integrity of its online services, emphasizing that the leak did not compromise any personal information belonging to gamers.
The arrest of van der Stap may signal a turning point in the law‑enforcement effort to dismantle ShinyHunters, but authorities caution that the group’s decentralized nature could allow other members to continue operations under new aliases. As the FBI and Dutch police continue to collaborate, the broader cybersecurity community watches closely, hoping that the case will set a precedent for how transnational cyber‑criminal enterprises are pursued and prosecuted.
Overall, the incident underscores the high stakes involved when cyber‑attackers target the lucrative world of online gaming. With billions of dollars at play, companies must remain vigilant, invest in robust defensive measures, and be prepared to respond swiftly when breaches occur. The ShinyHunters saga serves as a stark reminder that even the most well‑funded and popular digital platforms are not immune to sophisticated, financially motivated cyber‑crime.