Loading story…
Atlas Menu, a cheat service for Grand Theft Auto V and Counter-Strike 2, suffered a breach in May that exposed data tied to roughly 64,000 accounts. Multiple reports said an attacker claimed to have compromised all Atlas systems and then published the stolen database in a public GitHub repository. The leaked records reportedly included email addresses, usernames, IP addresses, support tickets, and passwords stored as bcrypt hashes; other reporting said the dump also contained license keys, signup dates, Rockstar Games account identifiers, banned-user lists, and administrator logs. Atlas Menu’s site later went offline, and no clear intrusion method or official company explanation had been disclosed.
The attacker allegedly described the intrusion as retaliation against a scammer, while breach-tracking service Have I Been Pwned added the incident to its database and UpGuard assessed it as a medium-severity exposure. Although the passwords were hashed, the combination of account data, IP addresses, and support history raises risks of credential stuffing, phishing, social engineering, and doxing, particularly for users who reused passwords or tied their real identities to the service. The breach also drew attention to allegations that Atlas software could capture screenshots while running, adding to concerns about the sensitivity of the exposed user base.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Atlasmenu.net disclosed a confirmed data breach on June 2, 2026, saying an unidentified threat actor had allegedly compromised its internal systems during May 2026. The disclosure said approximately 64,000 accounts were affected and that the stolen database had allegedly been published online.
In May 2026, an unidentified attacker allegedly breached Atlas Menu's systems and accessed internal infrastructure and customer data. Multiple reports say the actor claimed to have compromised all Atlas systems.
Following the incident, Atlas Menu's website was reported to be down or offline. Reports noted the company had not issued an official response at the time of coverage.
Have I Been Pwned added Atlas Menu to its breach database, stating that roughly 64,000 unique email addresses were exposed. The listing described the compromised data as including email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords.
After the intrusion, the attacker allegedly published the stolen Atlas Menu database in a public GitHub repository. The leaked data was reported to include about 64,000 accounts with email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords, with some reports also citing license keys and internal logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcexakep.ru
Open sourcehelpnetsecurity.com
Open sourceupguard.com
Open sourcescworld.com
Open sourcetheregister.com
Open sourcetechcrunch.com
Open sourcehaveibeenpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
A publicly accessible database containing **~149.4 million unique usernames and passwords** (about **96GB** of data) was discovered online by security researcher **Jeremiah Fowler**. The trove included not just credential pairs but also associated site links, indicating it was designed to enable direct account access across many services; major concentrations included **Gmail (48M)**, **Facebook (17M)**, **Instagram (6.5M)**, **Yahoo (4M)**, **Netflix (3.4M)**, **Outlook (1.5M)**, **iCloud (900K)**, and **Binance (420K)**. The database was reportedly **not encrypted and not password-protected**, and it also contained credentials tied to **.gov domains** from multiple countries, raising risks of follow-on activity such as spearphishing, impersonation, and potential access attempts against government networks. Fowler reported the exposure to the hosting provider, and the database was subsequently **removed for terms-of-service violations**; Fowler said he could not determine who owned or operated the dataset. Reporting indicates the database likely aggregated logs from **infostealer malware**, which commonly uses techniques like **keylogging** to capture credentials from infected devices; Fowler noted the dataset continued to **grow over roughly a month** while he worked to reach the host. The hosting arrangement was described as a global provider using regional affiliates, with the exposed instance attributed to an affiliate in **Canada**, and the provider was not publicly named.
Jun 29, 2026
Rockstar Games confirmed it was breached in an extortion campaign attributed to **ShinyHunters**, which claimed it had stolen confidential company data and threatened to publish it unless payment was made by April 14. Early reporting said the attackers may have reached Rockstar data through a third-party service, **Anodot**, with the compromise tied to Rockstar’s **Snowflake** environment rather than a direct intrusion into Rockstar’s own core systems. Subsequent reporting said the attackers allegedly hijacked Anodot authentication tokens to access Rockstar’s Snowflake instance, stealing what Rockstar described as **"non-material company information."** Reports said the exposed data may include corporate documents such as **GTA 6 marketing plans**, while the game’s source code is not believed to be involved. Rockstar said the incident did not affect operations or players, and the case is being viewed as part of a broader pattern of ShinyHunters-linked compromises involving Snowflake environments connected through third-party integrations.
Jun 29, 2026