Rockstar Games has another security mess on its hands because a hacking crew that goes by ShinyHunters is now saying it got inside a tool Rockstar was using to keep tabs on how much the company spends on cloud stuff. The group has been doing this since 2020, and their name comes from shiny Pokémon hunting, which sounds silly, but these are the same people who have hit Google, AT&T, Ticketmaster, and GitHub, and a bunch of universities ranging from Harvard to Princeton over the past six years.
The group posted on its dark web leak site, claiming it got into Rockstar’s Snowflake environment, which is a cloud data platform, and pulled out large amounts of corporate data. ShinyHunters gave Rockstar until April 14 to pay a ransom, or the stolen data will go public, and based on what this group has done in the past, that is not an empty threat.
ShinyHunters Used Stolen Tokens From A Third-Party Tool To Access Rockstar’s Cloud Data
ShinyHunters did not hack Snowflake directly. What they said they did was compromise Anodot, which is a business monitoring tool that Rockstar uses to track how much it is spending on cloud services, and once they were inside Anodot, they got their hands on authentication tokens that Rockstar was using to connect Anodot to Snowflake.
With those tokens, ShinyHunters was able to log into Rockstar’s Snowflake environment and look like a normal user, which is how they say they pulled the data out without getting caught right away. That kind of credential-based attack is one of the more common ways companies get breached because third-party tools often have access to internal systems, and if one of those tools goes down then everything it touches is exposed.
ShinyHunters says the data it grabbed is internal company information and has nothing to do with player accounts or user data, which is good, but that does not mean Rockstar is off the hook. Google’s own threat research team has tracked ShinyHunters and found that the group likes to grab business data from cloud platforms and then demand money to keep it private, and when companies say no, the data ends up online.
Related: GTA 6 Online Will Reportedly Launch Within A Month Of The Main Game
That is what happened with Odido, which is a phone carrier in the Netherlands, and it also happened with Crunchbase, and with Harvard, and in every case, the group dumped what it had after the deadline passed. Rockstar has stayed completely silent about the whole thing, and April 14 is right around the corner.
Rockstar Already Got Hacked In 2022 When Lapsus$ Leaked Early ‘GTA 6’ Footage
This is not the first time someone has gotten into Rockstar’s stuff. Back in September 2022, the Lapsus$ crew tricked one of Rockstar’s own workers into handing over login information, and that is how they ended up with early ‘GTA 6’ footage that spread everywhere online almost overnight.
The whole thing got traced back to a teenager in Oxford named Arion Kurtaj, who was 18 at the time and was already out on bail for going after BT/EE and Nvidia before that. What made the story even crazier is that the BBC said Kurtaj had police watching over him when he did the Rockstar job, and he apparently managed to do all of it with nothing but a hotel TV, a Fire Stick, and his phone. A judge eventually put him in a secure hospital on an indefinite order at the end of 2023, and he is still there as far as anyone knows.
In Case You Missed: Disney And Epic Games’ First Joint Project Is Reportedly An Extraction Shooter
‘GTA 6’ is in the final stretch right now with a November 19, 2026, release date that Take-Two locked in back in February, and marketing and pre-orders are expected to start in the summer. Rockstar getting hit with another breach while the game is this close to launch is bad timing, no matter how you look at it, and if ShinyHunters does not get paid by April 14, then whatever they took is going up on their leak site for anyone to see. Rockstar has stayed quiet so far, but that is not going to be an option for much longer.
