Dutch Police Arrest Alleged ShinyHunters Leader Linked to Rockstar Breach

Dutch police have arrested a 24-year-old Amsterdam man suspected of involvement in ShinyHunters, the hacking and extortion group that claimed responsibility for April's Rockstar Games data breach. The FBI describes him as one of the group's alleged leaders, making the arrest a significant development in an investigation that reaches well beyond the games industry.

Police arrested the man on September 15 and announced details on September 29. A Rotterdam court has since ordered him to remain in pretrial custody for another 90 days. Alongside suspected participation in a criminal organization, he faces a separate investigation into alleged attempts to instigate two murders abroad.

For GTA players, ShinyHunters is the name attached to the ransom threat and subsequent leak of Rockstar's internal business data earlier this year. That incident exposed information about the company's online games rather than the development footage associated with other Grand Theft Auto VI leaks.

What Dutch police say they found

According to the Dutch police statement, investigators found information on the suspect's laptop concerning two murders that were allegedly intended to take place outside the Netherlands. Police say there are indications that he gave instructions for them, which is why they are investigating attempted incitement to murder.

The statement does not say those killings happened. It also explicitly separates that suspicion from the ShinyHunters investigation. Investigators have seized several data-storage devices, and police say further arrests remain possible.

Police have not publicly named the suspect. Reuters reports that Benjamin Korper of Amsterdam cybersecurity firm Neo Security identified him as Pepijn van der Stap, the company's offensive security lead. That job involves testing systems for weaknesses so they can be fixed.

Van der Stap was convicted of data theft and extortion in 2023 and later publicly renounced cybercrime. Korper told Reuters that he had vetted and monitored him before the arrest, and that an outside investigation had so far found no evidence of attacks against Neo Security or its clients. ShinyHunters denied that Van der Stap had any association with the group. Reuters was unable to reach him or identify a lawyer or representative for comment.

How ShinyHunters became a Rockstar story

The Rockstar connection goes back to April's third-party data breach. ShinyHunters posted a ransom threat on April 11, claiming access to company data and demanding payment by April 14. The group threatened to publish the material if Rockstar did not pay.

The reported breach ran through Anodot, a cloud analytics provider, rather than Rockstar's game-development systems. Attackers used stolen authentication tokens to access Rockstar's analytics data in Snowflake, a service for storing and analyzing large datasets.

Rockstar acknowledged that a limited amount of company information had been accessed through a third-party breach. Its statement said the incident had "no impact on our organization or our players."

The subsequent Rockstar data dump exposed reported revenue, spending and engagement figures for GTA Online and Red Dead Online. The leaked records put GTA Online's average revenue at around US$1.3 million a day over the six months leading up to the April breach.

The records also prompted a closer look at player counts and revenue across PC and consoles. Those glimpses into Rockstar's business made the April leak notable: it revealed how its existing online games were performing, rather than revealing new GTA VI missions or footage.

Rockstar's other high-profile leaks belong to separate cases. The September 2022 breach exposed early GTA VI development footage. August 2026 brought a different footage and map leak under the CyberLeek name, followed by Take-Two's efforts to obtain identifying records from Microsoft and Discord.

The Dutch and FBI announcements concern alleged involvement in ShinyHunters. They do not identify this suspect as the person who carried out the Rockstar breach, and they do not connect him to either footage leak.

The FBI puts the alleged extortion haul at $70 million

The FBI's announcement describes an operation led by the Dutch High Tech Crime Unit with US support. Cyber Division Assistant Director Brett Leatherman says the suspect and his alleged co-conspirators have breached more than 140 organizations and taken at least US$70 million in extortion payments since last year. Those figures cover the broader alleged campaign, not Rockstar alone.

Leatherman describes a recurring method: target third-party vendors and cloud platforms, steal sensitive information, then threaten to publish it unless the victim pays. The reliance on suppliers is the same kind of exposure that brought Rockstar into the ShinyHunters story in April.

His message to the group's remaining members was direct: "The longer you stay in this, the more we learn about you." He urged them to contact the FBI, warning that arrests and seized infrastructure help investigators identify the people still involved.