Dutch law enforcement officials have taken into custody a 24‑year‑old man from Amsterdam as part of a broader probe into the activities of the notorious hacking outfit known as ShinyHunters. The group, which U.S.
authorities allege was responsible for a high‑profile data breach that disclosed confidential revenue figures for the popular online game GTA Online earlier this year, is now under intense scrutiny. The arrest was first reported by Rockstar Intel, a community‑run news source that frequently tracks security incidents involving Rockstar Games, and subsequently confirmed by the Dutch National Police in a press release dated September 28. While the official statement omitted the suspect's name, a later report from Reuters identified the individual as Pepijn van der Stap. Van der Stap is employed as the offensive cybersecurity lead at Neo Security, a consultancy based in Amsterdam that specializes in penetration testing and threat‑hunting services.
According to court records, van der Stap has a history of convictions related to hacking offenses, although he only joined Neo Security earlier in the current year. Despite his recent employment, the FBI maintains that he has been at the helm of ShinyHunters since 2025, a claim that the group itself has publicly denied.
In response to the allegations, ShinyHunters accused Dutch police of incompetence and mishandling the investigation. ShinyHunters has been linked to a staggering array of intrusions affecting more than one hundred organizations worldwide, ranging from entertainment giants like Rockstar Games to ticket‑selling platforms such as Ticketmaster, and even to government agencies including the FBI. Their modus operandi typically involves breaching corporate networks, exfiltrating sensitive data, and then leveraging that information for extortion or public exposure. In April, the group successfully infiltrated Rockstar's internal systems and attempted to extort the studio.
They threatened to release a cache of confidential documents unless Rockstar paid a ransom. The company refused to negotiate, but ShinyHunters went ahead and published the stolen files anyway. Among the leaked material was a financial snapshot showing that GTA Online, the persistent multiplayer component of Grand Theft Auto V, generates more than one million dollars in revenue each day.
This revelation confirmed long‑standing speculation about the game's profitability and provided a rare glimpse into the financial engine that powers one of the most lucrative digital entertainment products on the market. The leak added another layer of difficulty for Rockstar's internal security team, which had already been dealing with a separate incident earlier in August. That month, a different hacker collective known as CyberLeek released unauthorized gameplay footage of the highly anticipated GTA 6, prompting Take‑Two Interactive, Rockstar's parent company, to issue subpoenas to major tech platforms such as Microsoft, Discord, and X (formerly Twitter). The subpoenas were intended to trace the origin of the leak and identify the individuals responsible for the breach.
Following van der Stap's detention, Brett Leatherman, an assistant director in the FBI’s Cyber Division, issued a stark warning to any remaining members of ShinyHunters. In a recorded message, Leatherman said, "Now, to the remaining members of ShinyHunters: You've heard about the arrest of your colleague.
We're confident you've seen or heard things in recent days that the public has not. Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you.
You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." Leatherman's message underscores a broader strategy employed by law‑enforcement agencies worldwide: leveraging high‑profile arrests to sow doubt among remaining operatives, encouraging defections, and dismantling the technical infrastructure that supports illicit hacking campaigns. By publicly naming the arrested individual and highlighting the inevitability of detection, authorities aim to erode the sense of impunity that often shields cybercriminals.
Beyond the immediate legal ramifications, the incident occurs against a backdrop of ongoing labor disputes at Rockstar. The studio is currently embroiled in an employment tribunal with the Independent Workers' Union of Great Britain (IWUGB). The case centers on the dismissal of 34 employees in October of the previous year, an action the union claims was retaliatory and linked to union‑organizing activities.
While the tribunal is a separate matter from the hacking investigations, it adds to the mounting pressures facing Rockstar's management and public image. The convergence of cyber‑security breaches, financial disclosures, and labor controversies paints a complex picture of the challenges confronting modern video‑game publishers. On one hand, the industry must grapple with increasingly sophisticated threat actors who target both proprietary code and sensitive business data. On the other, companies must navigate internal workforce dynamics and external regulatory scrutiny.
In the wake of the arrest, cybersecurity experts anticipate that Neo Security will conduct an internal review to determine whether van der Stap's alleged activities were conducted independently or with the tacit approval of his employer. The firm has yet to release an official statement, but industry observers note that firms specializing in offensive security often walk a fine line between legitimate penetration testing and illicit hacking, making clear policy enforcement essential. Meanwhile, the FBI and Dutch authorities are likely to continue collaborating on cross‑border investigations, sharing intelligence, and pursuing additional suspects linked to ShinyHunters.
The broader goal is to dismantle the network's operational capabilities, seize any remaining command‑and‑control servers, and prevent future leaks that could compromise the financial stability of major entertainment enterprises. For gamers and investors alike, the revelation that GTA Online pulls in over a million dollars daily underscores the massive economic engine behind live‑service games. It also serves as a reminder that the digital assets supporting such revenue streams are prime targets for cyber‑criminals seeking both monetary gain and strategic leverage. As the legal process unfolds, stakeholders from law enforcement, corporate security, and labor representatives will be watching closely to see how this high‑profile case influences future policy, both in terms of cyber‑defense measures and employee relations within the gaming sector.