Rockstar Games Reportedly Hacked Again. ShinyHunters Demand Ransom by April 14
Hacking group ShinyHunters claims to have breached Rockstar Games via a third-party analytics tool, demanding a ransom by April 14 or threatening to leak corporate data publicly.
By _Ghillie ·
Rockstar Games is reportedly facing another major security breach, just months out from the release of GTA 6. Hacking group ShinyHunters posted on their dark web leak site today (April 11) claiming they have gained access to Rockstar's Snowflake data warehouse environment, and are demanding the studio pays a ransom by April 14 or the stolen data goes public.
How Did It Happen?
This time, the attackers didn't go through Rockstar directly. ShinyHunters say they compromised Anodot, a third-party SaaS cloud cost monitoring platform that Rockstar uses to track infrastructure spending. Because Anodot requires deep access to cloud systems to function, it held authentication tokens that connected directly to Rockstar's Snowflake database instances. Once ShinyHunters got into Anodot's systems, they pulled those tokens and were able to walk into Rockstar's environment without triggering any obvious alarms. The access reportedly looked like a routine internal process, giving the attackers time to run database exports before anything was flagged. Snowflake has since confirmed to BleepingComputer that Anodot suffered a security incident.
The group's message on the dark web was blunt: "Rockstar Games, your Snowflake instances were compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak, along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline."
What Data Is at Risk?
The breach appears to be focused entirely on corporate level data rather than individual player accounts. According to reports, the compromised material could include financial records from GTA Online and Red Dead Online, player spending habits, geographic data, marketing timelines, and contracts with Sony, Microsoft, voice actors, and music labels. There is currently no evidence that individual player passwords or payment details were accessed, but enabling two-factor authentication on your Rockstar Social Club account is still a sensible precaution.
Importantly, this is very different from the 2022 hack. That breach, carried out by 18-year-old Arion Kurtaj, exposed early GTA 6 gameplay footage and development assets. What ShinyHunters appear to hold is financial and contractual data, which means we shouldn't expect gameplay or source code to surface if they do follow through. That said, there is potential for revealing insights into Rockstar's production timelines, marketing plans for GTA 6, and possibly details about other unannounced projects.
Who Are ShinyHunters?
ShinyHunters have been operating since 2020 and have a long track record of following through on threats. Past targets include Microsoft, Ticketmaster, AT&T, Cisco, SoundCloud, and the European Commission. Earlier in 2026, the group also claimed access to Salesforce data from over 400 companies, publishing files from 26 of them. When they say they will leak, they usually do.
What Happens Next?
Rockstar Games and Take-Two Interactive have not issued any public statement at the time of writing. The April 14 deadline gives them very little time to respond, and companies in this position typically do not pay ransoms. If no payment is made, ShinyHunters have indicated they will begin releasing the data publicly.
We will keep this article updated as the situation develops.
Source: Kotaku