Amsterdam: Man Arrested in Probe of ShinyHunters, the Group That Claimed the Rockstar Hack

Dutch police have arrested a man the FBI calls one of the alleged leaders of ShinyHunters, the hacking group that claimed responsibility for breaching Rockstar Games in April.

The 24-year-old from Amsterdam was arrested on September 15, but police did not announce it until September 29. In their statement, the Dutch National Police said he is suspected of participating in a criminal organization. They did not name him, and they did not mention Rockstar.

On the same day, a Rotterdam court ruled that he will stay in pretrial detention for at least another 90 days. None of the allegations against him has been proven in court.

What police say they found

The man came to the attention of the country’s national investigation unit, whose Team High Tech Crime is investigating ShinyHunters under the authority of the National Public Prosecutor’s Office. Officers seized several data storage devices that are still being examined, and police have not ruled out more arrests.

Police described ShinyHunters as a criminal hacking and extortion group behind many large data breaches, including those at Dutch telecom company Odido, Pornhub and Ticketmaster. They added, however, that this man was not arrested as part of the Odido investigation.

The case took a darker turn after the arrest. According to police, a large amount of information found on his laptop included details of two murders that were meant to be carried out abroad, and there are indications that he ordered them. He is therefore also suspected of attempting to solicit two murders, an allegation police said is separate from the ShinyHunters investigation.

Stan Duijf, who is responsible for the police’s approach to cybercrime, said in the Dutch-language statement that “the ShinyHunters group is responsible for a large number of national and international victims.” The translation is by Game Empress.

The FBI’s warning to the rest of the group

The FBI went further than Dutch police in describing the suspect. In a video statement released the same day, Brett Leatherman, assistant director of the bureau’s Cyber Division, called him “one of the alleged leaders of ShinyHunters.” According to the FBI, the group has allegedly breached more than 140 organizations since last year and taken at least $70 million in extortion payments, often by targeting third-party vendors on cloud-based platforms.

Leatherman then turned to the members still at large. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left,” he said. “I suggest you reach out first while the choice is still yours.”

His message came after ShinyHunters claimed this month to have hacked the FBI’s own jobs portal. NBC News reported that the breach took place on September 21, after the Dutch arrest, and that the FBI has not explicitly tied the two.

ShinyHunters, for its part, says the man is not one of its own. A representative told TechCrunch that he “has no association with us.”

Where Rockstar comes in

Rockstar’s place in this story goes back to April. On April 11, ShinyHunters posted Rockstar’s name on its dark web leak site with a “pay or leak” demand and an April 14 deadline, Help Net Security reported. The group said it had got into Rockstar’s Snowflake data environment through Anodot, a third-party cloud cost monitoring service.

Rockstar confirmed a breach but said little else. “We can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach,” the company told Kotaku at the time. “This incident has no impact on our organization or our players.” It did not say who was responsible.

It also did not pay, according to Kotaku, and the group went on to release the data. Citing an analysis of the files posted on GTAForums, PC Gamer reported that GTA Online brought in $9.6 million a week between September 2025 and April 2026, or more than $1 million a day on average.

Anyone hoping for GTA 6 secrets came away with little, since PC Gamer said the files were mostly sales and financial figures. Rockstar showed the game’s first real gameplay itself in August, in the GTA 6 Extended Look.

That history explains the interest in this arrest, but so far the link runs through the group, not the man. Dutch police have not said whether he played any role in the Rockstar breach, and the FBI’s statement does not mention Rockstar at all.

The breach is also not the only security story around GTA 6. In a separate case with no known link to ShinyHunters, security firm Huntress warned in September about fake GTA 6 installers that carry file-destroying malware.

In the Netherlands, police say their investigation is continuing at full pace.

Featured image: The Rotterdam District Court building. Photo: Marcel Douwe Dekker / Wikimedia Commons (CC BY-SA 2.0)