Alleged ShinyHunters Leader Arrested Over Rockstar Games Breach That Exposed GTA Online’s Earnings

October 1, 2026 Noah

Dutch police have arrested a 24-year-old man from Amsterdam in connection with a cyberattack that hit Rockstar Games earlier this year. The arrest actually took place on September 15, but it wasn’t made public until the FBI and Dutch authorities announced it on September 29, alongside a warning aimed at other members of ShinyHunters, the hacking group the suspect is accused of helping lead.

The April Breach That Exposed GTA Online’s Earnings

The case traces back to an April 2026 breach in which attackers reportedly compromised Anodot, a third-party analytics vendor used by Rockstar, and reused stolen authentication tokens to reach Rockstar’s own Snowflake cloud data rather than hacking Rockstar’s systems directly. According to multiple reports on the leaked files, the data didn’t include unreleased game content or player information, but it did include internal revenue, spending, and engagement figures for GTA Online and Red Dead Online, including an average daily revenue for GTA Online of roughly $1.3 million over the six months before the breach. Those figures come from the leaked data itself rather than any confirmation from Rockstar, which said in a statement that “a limited amount of non-material company information was accessed” and that the incident had no impact on its organization or players.

Official Steam artwork for Grand Theft Auto V and GTA Online

GTA Online, the live-service game whose internal revenue figures were reportedly exposed in the breach

Who Is the Suspect

Dutch police haven’t officially named the suspect beyond confirming he’s a 24-year-old man from Amsterdam, but multiple outlets have identified him as Pepijn van der Stap. He isn’t a stranger to cybercrime cases: van der Stap was sentenced in November 2023 to four years in prison, one of them suspended, plus a probation period, for an earlier hacking and extortion operation he ran under the alias “Umbreon.” The FBI’s cyber division named him as an alleged leader of ShinyHunters, which the agency says has breached more than 140 organizations and collected at least $70 million in extortion payments since last year. FBI Assistant Director Brett Leatherman posted a video message aimed at the rest of the group, warning that “we know how to find you. I suggest you reach out first.”

A Separate, More Serious Allegation

Beyond the hacking case, Dutch police said they also found information on the suspect’s devices related to two murders allegedly planned to be carried out abroad. That claim hasn’t been independently verified beyond the police’s own statement, and no further details, including names or locations, have been disclosed. A court in Rotterdam has ordered him held for an additional 90 days of pretrial custody while the investigation continues.

ShinyHunters Denies the Connection

ShinyHunters itself has pushed back on the arrest, telling reporters the suspect “has no association with us.” The group, which has been linked to breaches at companies including Ticketmaster and even the FBI itself, has a long history of using extortion and public leaks as pressure tactics, and it isn’t unusual for its members to dispute law enforcement’s claims about who is actually involved. Whether or not this particular arrest holds up, authorities have made clear they consider it part of a broader crackdown that isn’t finished yet.