Dutch law enforcement officials have placed a 24‑year‑old man from Amsterdam under arrest as part of a broader probe into the activities of the notorious hacking collective known as ShinyHunters. The group, which U.S. authorities allege was responsible for a high‑profile data breach that disclosed confidential financial figures for Rockstar Games' online service GTA Online earlier this year, has been under intense scrutiny since the leak surfaced. The arrest was first reported by Rockstar Intel, a fan‑run news outlet that frequently aggregates information from sources such as Kotaku.
In a press release dated September 28, the Dutch National Police confirmed that a suspect had been detained, though they initially withheld the individual's name. Subsequent reporting by Reuters identified the detained individual as Pepijn van der Stap, a 24‑year‑old who serves as the offensive cybersecurity lead at Neo Security, a boutique security firm based in Amsterdam.
Van der Stap's professional background is a mixture of legitimate cybersecurity work and a series of prior convictions for offenses linked to unauthorized computer access. He reportedly joined Neo Security earlier in the year, despite the fact that the FBI believes he has been at the helm of ShinyHunters since 2025. The hacker group, which has repeatedly denied any leadership role for van der Stap, has also accused Dutch police of mishandling the investigation.
ShinyHunters has built a reputation for targeting a wide array of high‑profile organizations. Over the past few years, the collective has been linked to intrusions at more than one hundred companies and public institutions, ranging from entertainment giant Rockstar Games to ticket‑selling platform Ticketmaster, and even to the Federal Bureau of Investigation itself.
Their modus operandi typically involves breaching a target's network, exfiltrating sensitive data, and then attempting to extort the victim by threatening to release the stolen information unless a ransom is paid. In April, the group successfully infiltrated Rockstar's internal systems and issued an extortion demand.
They warned the studio that if a payment was not forthcoming, they would publish a cache of confidential documents. Rockstar refused to capitulate, and the hackers followed through on their threat, publishing a trove of data that revealed GTA Online generates more than $1 million in revenue each day. This disclosure not only embarrassed the developer but also provided a rare glimpse into the financial performance of one of the most lucrative live‑service games on the market. The GTA Online leak added to a string of recent security incidents that have plagued Rockstar and its parent company, Take‑Two Interactive.
In August, a separate hacker group calling itself CyberLeek leaked unreleased gameplay footage from the highly anticipated GTA 6. That breach prompted Take‑Two to issue subpoenas to major technology platforms—including Microsoft, Discord, and Twitter (now X)—in an effort to trace the origins of the leak and hold the perpetrators accountable. Following van der Stap's arrest, Brett Leatherman, an assistant director with the FBI's Cyber Division, issued a stark warning to the remaining members of ShinyHunters.
In a public statement, Leatherman said, "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not. Other groups believed anonymity, or their friends, would protect them, and they were wrong.
Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you.
I suggest you reach out first while the choice is still yours." Leatherman's message underscores a broader law‑enforcement strategy of applying pressure on cybercriminal networks by publicly naming arrests and offering potential collaborators a chance to mitigate their legal exposure by cooperating. By highlighting the inevitability of detection and the diminishing returns of continued illicit activity, the FBI hopes to erode the group’s cohesion and encourage insiders to provide valuable intelligence. The arrest also arrives at a tumultuous time for Rockstar itself. The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB).
The dispute centers on the dismissal of 34 employees in October of the previous year, a move the union alleges was retaliatory and linked to union organizing activities. The legal battle adds another layer of complexity to Rockstar's public relations challenges, as the company must navigate both external cyber threats and internal labor disputes.
Industry analysts view the ShinyHunters episode as a cautionary tale about the growing sophistication of financially motivated hacking groups. While many cyber‑attacks in the past were driven by political motives or simple vandalism, groups like ShinyHunters demonstrate a hybrid approach: they combine technical prowess with a clear business model that seeks monetary gain through extortion and the sale of stolen data. The GTA Online revenue leak, in particular, highlighted how a single breach can have far‑reaching implications for a company's market perception, investor confidence, and competitive positioning. In response to the incident, Rockstar has reportedly bolstered its internal security protocols, increased monitoring of privileged accounts, and engaged third‑party cybersecurity firms to conduct comprehensive penetration testing.
The company also emphasized its commitment to protecting player data and maintaining the integrity of its online services, reassuring its massive player base that steps are being taken to prevent future breaches. The broader gaming industry is watching closely.
As live‑service models become the norm, the financial stakes associated with in‑game purchases, subscription services, and digital economies continue to rise. This makes gaming companies attractive targets for groups seeking to monetize leaked financial data or disrupt revenue streams. Experts suggest that the industry must adopt a more proactive stance, integrating threat intelligence sharing, regular security audits, and employee training to mitigate the risk of insider threats and external attacks.
In summary, the detention of Pepijn van der Stap marks a significant development in the ongoing investigation into ShinyHunters and their high‑profile attacks on companies like Rockstar Games. While the full impact of the arrest on the group's operations remains to be seen, the FBI's public outreach and the heightened scrutiny from law‑enforcement agencies worldwide signal a concerted effort to dismantle the network.
For Rockstar, the incident serves as both a wake‑up call and an opportunity to reinforce its cybersecurity defenses while navigating the parallel challenges of a labor dispute and the ever‑evolving landscape of digital threats.