Loading story…
Rockstar Games confirmed that attackers accessed a limited amount of non-material internal company information through a third-party breach after the ShinyHunters group claimed it had infiltrated cloud-connected systems and demanded payment under a "pay or leak" ultimatum. Rockstar said the incident did not affect players or core operations, and reporting indicates the intrusion likely stemmed from compromised access tied to analytics vendor Anodot and Rockstar’s Snowflake-connected environment rather than a direct breach of Rockstar’s own infrastructure.
After Rockstar reportedly did not meet the ransom demand, ShinyHunters said it would publish the stolen data, and subsequent reports said 78.6 million records were released. Early assessments described the exposed material as internal corporate data such as contracts, financial documents, and marketing plans rather than player information, but the leak still created extortion, confidentiality, and supply-chain risk concerns for the game publisher as it prepares major releases including Grand Theft Auto VI.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By April 14, reports indicated the attackers had published a large dataset they claimed was stolen from Rockstar, described in one report as 78.6 million records. The leak appeared to follow the previously announced extortion deadline.
Follow-up reporting said ShinyHunters planned to release the allegedly stolen Rockstar data after its ransom demands were not met. This marked an escalation from extortion threats to an announced intent to publish the material.
Early reporting indicated the intrusion may have stemmed from compromised authentication tokens tied to analytics vendor Anodot, which had integration with Rockstar systems, rather than a direct breach of Snowflake itself. This added technical detail reframed the incident as a third-party or supply-chain compromise.
Rockstar Games confirmed that unauthorized access occurred through a third-party data breach and said only a limited amount of non-material internal company information was accessed. The company stated the incident had no impact on its organization or players.
ShinyHunters publicly claimed it had accessed Rockstar Games data via a third-party/cloud environment and threatened to leak the stolen material unless a ransom was paid. Multiple reports say the group set a 'pay or leak' deadline of April 14, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
techradar.com
Open sourcekotaku.com
Open sourcethecyberexpress.com
Open sourcetheregister.com
Open sourceengadget.com
Open sourcepcgamer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rockstar Games confirmed it was breached in an extortion campaign attributed to **ShinyHunters**, which claimed it had stolen confidential company data and threatened to publish it unless payment was made by April 14. Early reporting said the attackers may have reached Rockstar data through a third-party service, **Anodot**, with the compromise tied to Rockstar’s **Snowflake** environment rather than a direct intrusion into Rockstar’s own core systems. Subsequent reporting said the attackers allegedly hijacked Anodot authentication tokens to access Rockstar’s Snowflake instance, stealing what Rockstar described as **"non-material company information."** Reports said the exposed data may include corporate documents such as **GTA 6 marketing plans**, while the game’s source code is not believed to be involved. Rockstar said the incident did not affect operations or players, and the case is being viewed as part of a broader pattern of ShinyHunters-linked compromises involving Snowflake environments connected through third-party integrations.
Jun 29, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026