{"id":12095,"date":"2026-04-14T10:04:40","date_gmt":"2026-04-14T10:04:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/14\/rockstars-gta-game-hacked-attackers-published-78-6-million-records-online\/"},"modified":"2026-04-14T10:04:40","modified_gmt":"2026-04-14T10:04:40","slug":"rockstars-gta-game-hacked-attackers-published-78-6-million-records-online","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/14\/rockstars-gta-game-hacked-attackers-published-78-6-million-records-online\/","title":{"rendered":"Rockstar\u2019s GTA Game Hacked \u2013 Attackers published 78.6 Million Records Online"},"content":{"rendered":"<p>    Rockstar\u2019s GTA Game Hacked \u2013 Attackers published 78.6 Million Records Online<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>Rockstar Games has confirmed a data breach after the notorious hacking group ShinyHunters exploited a third-party integration to access the company\u2019s internal Snowflake data warehouse, ultimately leaking over 78.6 million records on April 14, 2026.<\/p>\n<p>The breach did not stem from a direct attack on Rockstar\u2019s infrastructure. Instead, ShinyHunters leveraged Anodot, an AI-powered cloud cost monitoring and analytics SaaS platform that Rockstar uses to manage its digital infrastructure.<\/p>\n<p>Attackers reportedly extracted authentication tokens from Anodot\u2019s systems, allowing them to impersonate a legitimate internal service and silently traverse into Rockstar\u2019s connected <a href=\"https:\/\/cybersecuritynews.com\/hacker-behind-snowflake-data-breach-arrested\/\" target=\"_blank\" rel=\"noreferrer noopener\">Snowflake data<\/a> warehouse.<\/p>\n<p>Notably, no vulnerability in Snowflake itself was exploited; the tokens provided trusted, seemingly legitimate access that initially evaded detection.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-rockstar-s-gta-game-hacked\"><strong>Rockstar\u2019s GTA Game Hacked<\/strong><\/h2>\n<p>Anodot had itself flagged connectivity issues as early as April 4, noting that its data collectors were offline across regions, including Snowflake, Amazon S3, and Amazon Kinesis.<\/p>\n<p>The timeline suggests the compromise was already underway before Rockstar was made aware. ShinyHunters is known for precisely this type of supply-chain pivot targeting identity systems, API keys, and third-party integrations rather than relying on traditional exploits.<\/p>\n<p>On April 11, 2026, ShinyHunters posted a warning on their dark web leak site: \u201cRockstar Games! Your Snowflake instances were compromised thanks to Anodot.com. Pay or leak.<\/p>\n<p>This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that\u2019ll come your way.\u201d. When Rockstar declined to negotiate consistent with global law enforcement guidance against paying ransoms, the group confirmed to the BBC that it would release the stolen data.<\/p>\n<p>The leaked archive contains 78.6 million records described as a multi-domain analytics dataset used for GTA Online (GTAO) and Red Dead Online (RDO).<\/p>\n<p><a href=\"https:\/\/gtaforums.com\/topic\/1004190-gta-vi-delayed-to-november-19-2026\/page\/580\/#comment-1072663072\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">According to data from the leak<\/a>, GTA Online generated approximately $500 million annually, driven by roughly $7.3 million in weekly Shark Card sales and $2.3 million in GTA+ subscription revenue. Platform-level breakdowns reveal PS5 as the top revenue driver with $4.49 million in weekly bookings and 3.47 million weekly active users, followed by Xbox Series X at $1.87 million weekly.<\/p>\n<p>Player activity metrics show GTAO averaging 9.9 million weekly active users and peaking at 15.4 million, while RDO averaged 969,848 weekly active users. Crucially, no player passwords, payment details, personal identifiable information, source code, or GTA 6 development assets were part of the leak.<\/p>\n<p>In a statement issued to multiple outlets, <a href=\"https:\/\/kotaku.com\/rockstar-games-reportedly-hacked-massive-data-leak-ransom-gta-6-shinyhunters-2000686858\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">including Kotaku<\/a> and IGN, a Rockstar Games spokesperson confirmed: <em>\u201cWe can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach. This incident has no impact on our organization or our players.\u201d<\/em><\/p>\n<p>This incident reinforces a persistent and escalating threat pattern: <a href=\"https:\/\/cybersecuritynews.com\/cisa-warns-of-supply-chain-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">supply-chain attacks <\/a>via trusted SaaS integrations. ShinyHunters has previously breached Ticketmaster, AT&amp;T, Microsoft, and Cisco using similar vectors.<\/p>\n<p>The Anodot-to-Snowflake pivot underscores that even organizations with hardened internal environments remain exposed through third-party connectors that hold privileged access credentials<\/p>\n<p> Security teams are advised to audit all SaaS integrations for least-privilege access, rotate authentication tokens regularly, and monitor for anomalous Snowflake query behavior as early indicators of lateral movement through third-party tooling.<\/p>\n<p>Updated: April 14, 2026 \u2014 ShinyHunters has now published the dataset following Rockstar\u2019s refusal to pay the ransom demand.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 94%,rgb(169,184,195) 100%)\"><strong>Follow us on <a href=\"https:\/\/news.google.com\/publications\/CAAqMggKIixDQklTR3dnTWFoY0tGV041WW1WeWMyVmpkWEpwZEhsdVpYZHpMbU52YlNnQVAB?hl=en-IN&amp;gl=IN&amp;ceid=IN:en\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google News<\/a>, <a href=\"https:\/\/www.linkedin.com\/company\/cybersecurity-news\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">LinkedIn<\/a>, and <a href=\"https:\/\/x.com\/cyber_press_org\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">X<\/a> for daily cybersecurity updates. <a href=\"https:\/\/cybersecuritynews.com\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Contact us<\/a> to feature your stories.<\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/rockstars-gta-game-hacked\/\">Rockstar\u2019s GTA Game Hacked \u2013 Attackers published 78.6 Million Records Online<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Guru Baran<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/rockstars-gta-game-hacked\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Rockstar\u2019s GTA Game Hacked \u2013 Attackers published 78.6 Million Records Online Rockstar Games has confirmed a data breach after the notorious hacking group ShinyHunters exploited a third-party integration to access the company\u2019s internal Snowflake data warehouse, ultimately leaking over 78.6 million records on April 14, 2026. The breach did not stem from a direct attack [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1636,129,63],"tags":[130],"class_list":["post-12095","post","type-post","status-publish","format-standard","hentry","category-cyber-attack-news","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12095"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=12095"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/12095\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=12095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=12095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=12095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}