Dutch law enforcement officials have apprehended a 24‑year‑old man from Amsterdam as part of a broader probe into the cyber‑criminal outfit known as ShinyHunters. According to the FBI, this group was behind a high‑profile data breach that unveiled confidential financial information about Rockstar Games' online service, GTA Online, earlier this year. The arrest was first reported by Rockstar Intel and later confirmed by Kotaku, which cited a statement from the Dutch National Police dated September 28. While the police statement omitted the suspect's name, a Reuters report identified him as Pepijn van der Stap.
Van der Stap holds the position of offensive cybersecurity lead at Neo Security, a security firm based in Amsterdam, and he reportedly joined the company only in 2024. His criminal record includes prior convictions for hacking‑related offenses, and the FBI alleges that he has been directing ShinyHunters since 2025, a claim the group itself denies, accusing Dutch authorities of mishandling the case. ShinyHunters has earned a notorious reputation for infiltrating more than a hundred organizations across various sectors.
Their alleged targets span from entertainment giants like Rockstar Games to ticketing powerhouse Ticketmaster, and even the Federal Bureau of Investigation itself. In April, the group breached Rockstar's internal systems and attempted to extort the studio, threatening to publish stolen confidential data unless a ransom was paid.
Rockstar refused to comply, yet ShinyHunters released the data regardless, revealing that GTA Online generates over one million dollars in revenue each day. This disclosure not only highlighted the financial magnitude of the game but also underscored the vulnerabilities in Rockstar's security posture. The incident adds to a string of recent security challenges for Rockstar and its parent company, Take‑Two Interactive. Earlier in August, another hacker collective known as CyberLeek leaked gameplay footage of the highly anticipated GTA 6.
That leak prompted Take‑Two to issue subpoenas to major technology platforms—including Microsoft, Discord, and X (formerly Twitter)—in an effort to trace the perpetrators and prevent further unauthorized disclosures. Following the Amsterdam arrest, Brett Leatherman, an assistant director in the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters. He addressed the group directly, stating, "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not.
Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you.
I suggest you reach out first while the choice is still yours." Leatherman's message underscores the FBI's strategy of applying pressure on cyber‑criminal networks by publicly naming arrests and offering potential leniency to those who cooperate. The agency hopes that the combination of legal action and the seizure of digital infrastructure will deter further illicit activity and encourage insiders to come forward. Beyond the immediate legal ramifications, the arrest occurs against the backdrop of ongoing labor disputes at Rockstar.
The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB). The union alleges that Rockstar unjustly terminated 34 employees in October of the previous year as retaliation for their involvement in union organizing.
This legal battle adds another layer of complexity to Rockstar's public image, as the company navigates both external cyber threats and internal workforce challenges. The ShinyHunters case highlights several broader trends in the cybersecurity landscape.
First, it illustrates how organized hacking groups can target high‑value entertainment companies, seeking both financial gain and the strategic advantage of exposing sensitive business data. Second, it demonstrates the increasing collaboration between international law‑enforcement agencies—such as Dutch police and the FBI—to track and dismantle transnational cyber‑crime operations.
Finally, the incident serves as a reminder to corporations about the importance of robust defensive measures, regular security audits, and rapid incident response capabilities. For Rockstar, the breach has likely prompted a reevaluation of its security architecture. The exposure of daily revenue figures not only provided a glimpse into the company's financial health but also revealed potential gaps in data segregation, access controls, and monitoring. In response, the studio may invest in advanced threat detection tools, conduct comprehensive penetration testing, and strengthen employee training programs to mitigate insider threats.
In summary, the detention of Pepijn van der Stap marks a significant development in the ongoing investigation into ShinyHunters, a group responsible for a cascade of high‑profile intrusions. While the suspect's legal fate remains to be seen, the case underscores the persistent risk posed by sophisticated hacking collectives and the necessity for both private sector firms and public agencies to work together in defending against cyber‑espionage and extortion attempts.