ShinyHunters Breach Rockstar Games via Third-Party Cloud Exploit, Release Financial Data After GTA VI Maker Refuses Ransom
Hackers exploited Anodot's integration with Rockstar's Snowflake cloud to steal nearly 80 million records of financial and analytics data, then published them after the studio refused to pay.
Overview
Rockstar Games, the studio behind Grand Theft Auto and Red Dead Redemption, has confirmed a data breach in which the cybercrime group ShinyHunters exfiltrated corporate records through a compromised third-party analytics provider. The hackers issued a ransom deadline of April 14, 2026, and after Rockstar declined to pay, released the stolen data a day early on April 13. The company has maintained that the breach involves only “non-material company information” and has no impact on players or its upcoming titles.
What We Know
ShinyHunters gained access to Rockstar’s Snowflake cloud environment by exploiting a vulnerability in Anodot, an AI-powered business analytics platform that the studio used for cloud cost monitoring, according to Tom’s Hardware. The group extracted authentication tokens from the compromised Anodot service, which functioned as trusted credentials between platforms, allowing them to query Rockstar’s Snowflake instances without triggering standard intrusion alerts.
The breach was first disclosed on April 11, 2026, when ShinyHunters posted on their dark web leak site with the message: “Rockstar Games, your Snowflake instances were compromised thanks to Anodot.com. Pay or leak,” as reported by Tom’s Hardware.
The hackers claimed to have stolen approximately 78.6 million records, according to Kotaku. The released data consisted primarily of financial metrics rather than game assets or source code. Leaked materials included revenue data from GTA Online and Red Dead Online, daily and weekly earnings figures, and country-specific player spending patterns, as Kotaku reported.
The group denied earlier reports that they had demanded $200,000, stating in their release message that “this data was never for sale like reported on X (formerly Twitter) for $200k,” according to Kotaku.
Rockstar confirmed the breach to Engadget and Kotaku, stating that “a limited amount of non-material company information was accessed in connection with a third-party data breach” and that “this incident has no impact on our organization or our players.” Snowflake separately acknowledged awareness of the Anodot breach and confirmed it was assisting affected customers, as reported by TechRadar.
What We Don’t Know
Several questions remain unanswered. The full scope of the Anodot compromise has not been disclosed, though TechRadar reported that ShinyHunters targeted dozens of companies through the same supply chain vulnerability. It is unclear how many other organizations were affected or whether additional data releases are forthcoming.
Rockstar has not addressed whether the leaked financial data reveals competitively sensitive information about microtransaction revenue or upcoming pricing strategies. The company also has not specified when it first learned of the breach or how long the attackers had access to its cloud environment.
The breach bears no apparent connection to Grand Theft Auto VI development materials. Multiple sources, including Tom’s Hardware and Engadget, noted that the incident is distinct from the 2022 Lapsus$ hack that exposed GTA VI gameplay footage and led to the conviction of an 18-year-old hacker. No game source code, development builds, or player credentials were part of the current leak.
Analysis
The Rockstar breach underscores the growing threat of supply chain attacks that exploit trust relationships between cloud services. Rather than targeting Rockstar’s infrastructure directly, ShinyHunters compromised a monitoring tool that held privileged access to the studio’s cloud data, a pattern that echoes the broader wave of Snowflake customer breaches that affected Ticketmaster and other major companies in 2024 and 2025.
For the gaming industry, the incident highlights how even non-player-facing corporate data carries significant value to threat actors. Revenue metrics, spending analytics, and business intelligence data can inform competitors, influence stock prices, or provide leverage for extortion, even when player accounts and game assets remain untouched.
Rockstar’s decision not to pay the ransom aligns with guidance from law enforcement agencies worldwide, which consistently advise against funding cybercriminal operations. The company’s refusal, and the subsequent data release, will likely intensify scrutiny of third-party vendor security practices across the gaming industry as studios prepare for a busy 2026 release calendar.