The ShinyHunters Breach
ShinyHunters' April 2026 claim of 78.6M records via a third-party analytics vendor; Rockstar confirmed a narrow breach with no GTA 6 material involved.
- Claimed
- April 2026, by ShinyHunters
- Records claimed
- 78.6 million
- Entry point
- Anodot third-party tokens into Snowflake environment
- Contents
- 25 files, ~7.54GB of business analytics
- Ransom
- $200,000, April 14 deadline
- Rockstar confirmation
- April 11, 2026 (narrow)
In April 2026 the hacking group ShinyHunters claimed to have stolen 78.6 million records from analytics environments tied to Rockstar, the one genuine security incident of the year against a backdrop of hoaxes, and one that never touched the game itself.
What happened
The entry point was not Rockstar's own systems but Anodot, a third-party cloud cost-monitoring service, whose stolen authentication tokens gave access to Rockstar data held in a Snowflake cloud environment; the group did not break Snowflake itself. The leaked set amounted to 25 files totalling roughly 7.54GB of internal business analytics: KPI reports, revenue breakdowns, virtual-currency redemption figures and regional performance data referencing GTA Online and Red Dead Online. ShinyHunters attached a $200,000 ransom demand carrying an April 14 deadline.
Rockstar's response
On April 11, 2026 Rockstar confirmed the incident while describing its scope narrowly, stating that "a limited amount of non-material company information was accessed in connection with a third-party data breach." No player accounts were affected, no game source code was taken, no GTA 6 build files were involved, and the November 19, 2026 release date was not impacted.
How to read it
Unlike the 2022 breach, nothing from the development pipeline escaped; the stolen material was financial and operational data sitting in a third-party monitoring tool. Interpretations of what the KPI files might reveal about GTA Online's profitability are analysis layered on the raw files, not statements from Rockstar, and belong in the analysis column rather than the fact column.