Rockstar Games faces April 14 ransom deadline following alleged data leak

Rockstar Games is reportedly facing another major security breach. Data breaches aren't something new for the company - in the high-profile 2022 incident, early developmental footage of Grand Theft Auto VI was leaked via a social engineering attack on the company’s internal Slack. This latest threat, if true, targets the studio's corporate data backend rather than the active game environment.

The claim originates from ShinyHunters, a threat group with a long history of targeting large-scale identity systems and API integrations. The group was previously linked to massive data thefts at Ticketmaster, AT&T, and Microsoft. Unlike the 2022 leak, which was the work of an individual, this operation appears to be part of a bigger campaign targeting companies that utilize specific cloud-based data warehousing and monitoring tools.

According to RansomLook.io and CyberSec Guru, the attackers did not compromise Rockstar’s perimeter directly. Instead, they allegedly leveraged an automated integration through Anodot, a third-party cloud-cost monitoring platform. The group claims to have gained access to Rockstar's Snowflake environment (which the company uses to store and manage, among other data, its analytical data and player telemetry) by harvesting authentication tokens from Anodot. Using this method, attackers can bypass standard multi-factor authentication by using legitimate service tokens that stay valid for extended periods. This type of supply-chain vulnerability seems to have become a primary vector for ShinyHunters throughout late 2025 and early 2026.

Rockstar is not the only big name in this coordinated wave. The group simultaneously listed victims including Amtrak and McGraw Hill, claiming to have compromised over 100 million records combined through third-party Salesforce integrations. The threat actors have established a ransom deadline of April 14. They are threatening to release the data if their demands are not met. Rockstar Games and its parent company, Take-Two Interactive, have not yet released an official statement or filed a regulatory disclosure regarding the incident.