Loading story…
Rockstar Games confirmed it was breached in an extortion campaign attributed to ShinyHunters, which claimed it had stolen confidential company data and threatened to publish it unless payment was made by April 14. Early reporting said the attackers may have reached Rockstar data through a third-party service, Anodot, with the compromise tied to Rockstar’s Snowflake environment rather than a direct intrusion into Rockstar’s own core systems.
Subsequent reporting said the attackers allegedly hijacked Anodot authentication tokens to access Rockstar’s Snowflake instance, stealing what Rockstar described as "non-material company information." Reports said the exposed data may include corporate documents such as GTA 6 marketing plans, while the game’s source code is not believed to be involved. Rockstar said the incident did not affect operations or players, and the case is being viewed as part of a broader pattern of ShinyHunters-linked compromises involving Snowflake environments connected through third-party integrations.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that ShinyHunters said it leaked more than 78.6 million records allegedly stolen from Rockstar Games, primarily internal analytics, support-related data, and operational metrics tied to online services. This appears to mark the public release of the data after the earlier extortion threat.
A Rockstar spokesperson acknowledged the incident and said the attackers obtained only 'non-material company information.' The company stated the breach did not affect operations or players.
ShinyHunters claimed responsibility for the intrusion and threatened to publicly leak the stolen Rockstar data unless payment was made. The extortion demand set an apparent deadline of April 14, 2026.
Reporting says attackers tied to ShinyHunters accessed Rockstar Games data by hijacking Anodot authentication tokens connected to Rockstar’s Snowflake environment, rather than directly breaching Rockstar systems or Snowflake itself. The exact scope of the stolen data was initially unclear, but reports suggested it involved corporate information rather than game source code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
17 references tracked. Mallory keeps watching after this page renders.
mitiga.io
Open sourcetechdirt.com
Open sourcehackread.com
Open sourcesecurityaffairs.com
Open sourcetomshardware.com
Open sourcekotaku.com
Open sourcethecybersecguru.com
Open sourcedexerto.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rockstar Games confirmed that attackers accessed a limited amount of **non-material internal company information** through a third-party breach after the **ShinyHunters** group claimed it had infiltrated cloud-connected systems and demanded payment under a "pay or leak" ultimatum. Rockstar said the incident did **not** affect players or core operations, and reporting indicates the intrusion likely stemmed from compromised access tied to analytics vendor **Anodot** and Rockstar’s Snowflake-connected environment rather than a direct breach of Rockstar’s own infrastructure. After Rockstar reportedly did not meet the ransom demand, ShinyHunters said it would publish the stolen data, and subsequent reports said **78.6 million records** were released. Early assessments described the exposed material as internal corporate data such as contracts, financial documents, and marketing plans rather than player information, but the leak still created extortion, confidentiality, and supply-chain risk concerns for the game publisher as it prepares major releases including **Grand Theft Auto VI**.
Jun 29, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
**ShinyHunters** is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace **CarGurus** in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included **12M+ email addresses** across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes). ShinyHunters also claimed to have stolen **800,000+ records** from **Wynn Resorts** and demanded **22.34 Bitcoin (~$1.5M)** to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including **Social Security numbers**, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in **September 2025** via an **Oracle PeopleSoft vulnerability** combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.
Jun 29, 2026