Dutch authorities have taken a significant step in the global crackdown against the notorious cybercriminal collective known as ShinyHunters. On September 28, the Dutch National Police confirmed the arrest of a 24-year-old man in Amsterdam, marking a major development in an ongoing international investigation into a string of high-profile data breaches. While the police initially withheld the identity of the suspect, subsequent reporting by Reuters identified him as Pepijn van der Stap, a figure who, paradoxically, has been employed as an offensive cybersecurity lead at Neo Security, an Amsterdam-based firm.
The arrest follows a long-term investigation into ShinyHunters, a group that the FBI and other international law enforcement agencies have tracked for years. The group has been linked to a vast array of intrusions targeting more than 100 corporations and public institutions globally. Among their most high-profile targets are Ticketmaster, the FBI itself, and the video game giant Rockstar Games. The suspect’s arrest is particularly notable given his professional role in the cybersecurity industry; he reportedly joined Neo Security earlier this year, despite federal investigators alleging that he has been a central leader of the ShinyHunters operation since 2025.
The investigation into the suspect’s alleged involvement with the group is multifaceted. According to details shared by the FBI and corroborated by investigative reporting, the group has been accused of orchestrating massive data exfiltration operations followed by extortion attempts. One such incident involved Rockstar Games, the developer behind the globally successful Grand Theft Auto franchise. In April, ShinyHunters successfully breached Rockstar’s internal systems and attempted to leverage the stolen, confidential information to extort the studio. When Rockstar refused to comply with the group’s financial demands, the hackers proceeded to leak the sensitive data to the public.
The leak provided a rare, unauthorized glimpse into the internal financial health of one of the world’s most secretive and successful gaming companies. Among the data released was documentation revealing that GTA Online—the multiplayer component of Grand Theft Auto 5—was generating more than $1 million in revenue every single day. The disclosure of such granular financial figures, while fascinating to industry analysts and fans, represented a significant security failure and a direct challenge to the corporate confidentiality maintained by Rockstar and its parent company, Take-Two Interactive.
The arrest of Van der Stap has sent shockwaves through the cybersecurity community, particularly given his documented history of hacking-related offenses. Reports indicate that the suspect has had prior brushes with the law regarding his digital activities. His ability to secure a role as an offensive cybersecurity lead—a position typically reserved for ethical hackers and security professionals tasked with identifying vulnerabilities to protect systems—raises uncomfortable questions about the vetting processes within the tech industry and the blurred lines between legitimate security research and malicious exploitation.
In the wake of the arrest, the hacking group itself has maintained a defiant stance. Reports suggest that ShinyHunters has publicly denied the claims brought against them and has responded with rhetoric accusing the Dutch police of incompetence. This posturing is consistent with the group’s historical behavior, which has often included taunting victims and law enforcement agencies following their digital incursions.
For Rockstar Games, this incident is merely the latest in a series of security-related challenges. The studio has been under immense pressure to secure its proprietary data as anticipation builds for the next installment in its flagship series, Grand Theft Auto 6. In August, the company suffered a separate, unrelated leak when the hacker group CyberLeek released early gameplay footage of the upcoming title. That incident prompted a robust legal response from Take-Two Interactive, which issued subpoenas to major tech platforms—including Microsoft, Discord, and X (formerly Twitter)—in a concerted effort to identify and hold the individuals responsible for the leak accountable.
The broader implications of the Dutch police’s action were highlighted by the FBI in a stern message to the remaining members of the ShinyHunters collective. Brett Leatherman, Assistant Director of the FBI’s Cyber Division, issued a public warning that served as both a reality check and an invitation for the remaining conspirators to surrender.
"Now, to the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague," Leatherman stated. "We’re confident you’ve seen or heard things in recent days that the public has not. Other groups believed anonymity, or their friends, would protect them, and they were wrong."
Leatherman emphasized that the arrest of one key member often creates a domino effect. "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."
This strategic move by the FBI reflects a growing trend in international law enforcement, where authorities focus on dismantling the infrastructure of hacking groups while systematically pressuring individual members to cooperate. By leveraging the fear of further arrests and the potential exposure of the group’s internal communications, law enforcement hopes to dismantle the organization from the inside out.
Beyond its cybersecurity struggles, Rockstar Games is currently navigating a period of internal turbulence. The studio is engaged in a high-profile employment tribunal with the Independent Workers’ Union of Great Britain (IWGB). The dispute centers on the dismissal of 34 staff members in October of last year. The affected employees, represented by the union, allege that their terminations were a form of retaliation for their involvement in union-organizing activities. The tribunal process, which has seen both sides outline their arguments, adds a layer of organizational strain to a company already grappling with high-stakes digital security threats.
The intersection of these events—the arrest of a suspected cybercriminal, the ongoing legal battles regarding labor practices, and the persistent threat of leaks from various hacking entities—paints a complex picture for Rockstar Games. The studio remains one of the most profitable and influential entities in the entertainment industry, but its reliance on absolute secrecy for its upcoming projects has made it a primary target for groups like ShinyHunters and CyberLeek.
As the legal proceedings against the 24-year-old suspect in Amsterdam move forward, the tech and gaming industries will be watching closely. The case serves as a stark reminder of the sophisticated nature of modern cyber threats and the global effort required to mitigate them. Whether the arrest of one alleged leader will significantly degrade the capabilities of ShinyHunters remains to be seen, but the FBI’s public statements suggest that the agency is confident that the momentum has shifted in favor of investigators.
For now, the focus remains on the judicial process in the Netherlands. The suspect’s background, his professional associations, and the specific evidence gathered by Dutch and American authorities will be central to the trial. As law enforcement continues to tighten its grip on digital criminal networks, the case of the Amsterdam-based cybersecurity professional serves as a definitive example of how the authorities are increasingly successful in piercing the veil of anonymity that these groups rely upon to operate. Rockstar Games, meanwhile, continues to operate under the shadow of these ongoing threats, balancing the demands of high-security development with the complexities of its corporate and labor relations.