The hacking group that leaked Rockstar Games’ internal financials earlier this year has lost one of its alleged leaders. Dutch police arrested a 24-year-old Amsterdam man on September 15, 2026, in connection with ShinyHunters, and announced the arrest publicly on September 29 — news that, according to Kotaku, ties directly back to the April breach that revealed just how much money GTA Online actually makes.

Who was arrested, and what he’s accused of

The man named across multiple reports is Pepijn van der Stap, previously known online by the handle “Umbreon.” By day, he worked in offensive cybersecurity roles at Amsterdam-based firms, having presented himself as reformed after a 2023 conviction tied to a string of data thefts and extortion schemes prosecutors said earned between €1.5 million and €2.7 million. The FBI alleges he’s been one of ShinyHunters’ leaders since 2025, and that the group — along with co-conspirators — has breached more than 140 organizations and collected at least $70 million in extortion payments. Dutch authorities say he’s also under separate investigation for allegedly attempting to arrange two murders abroad, though that inquiry isn’t connected to the Rockstar case specifically.

The breach that started it

ShinyHunters claimed responsibility for the Rockstar Games breach that became public in April 2026, after the company reportedly declined to pay a ransom. The group had compromised Rockstar’s Snowflake data warehouse, pulling an archive described as containing roughly 78.6 million records. Unlike the infamous 2022 GTA 6 footage leak, this breach wasn’t about unreleased game content — it exposed internal business analytics, including granular revenue figures for GTA Online that Rockstar has never disclosed publicly.

Those numbers turned out to be the real story. The leaked data showed GTA Online generating roughly $1.3 million in daily revenue on average since September 2025, translating to close to $500 million a year — figures corroborated across several outlets’ analysis of the leaked records, including comparisons showing Red Dead Online earning a comparatively modest $26.4 million annually by contrast. The reveal had a market effect nobody would have predicted from a hack: Take-Two’s stock rose on the news, adding roughly $1 billion to the company’s market capitalization as investors reacted to confirmation that GTA Online’s revenue engine, more than a decade after its launch, was still running at that scale.

Why this arrest is easy to miss

Coverage of the breach itself was wide back in April, but the arrest has landed with far less attention than the original leak — a gap that’s common with cybercrime follow-ups, where the initial hack draws headlines and the eventual law-enforcement action gets a fraction of the coverage months later. That’s despite the arrest being a bigger deal for the security world than for gaming specifically: ShinyHunters has also been tied to attacks on the FBI and extortion attempts against the ransomware group Cl0p, and Van der Stap’s arrest reportedly triggered an escalation in the remaining group’s activity rather than a retreat.

For Rockstar and Take-Two, the practical fallout from the breach was limited — GTA Online kept running, the leaked figures arguably helped the stock rather than hurt it, and the company’s real 2026 focus has remained the runup to GTA 6’s November 19 launch and its effect on Take-Two’s share price. But the arrest is a reminder that the extortion economy targeting game publishers’ internal data is bigger and more organized than any single incident suggests, run by groups treating entertainment companies as just one category of target alongside government agencies and other corporations.

For more on Rockstar’s other ongoing legal fights this year, see our coverage of the employment tribunal over 31 fired GTA 6 developers and how the GTA 6 leak itself hit Take-Two’s stock.