Rockstar Hacked Again, GTA 6 Data Could Leak Monday

Rockstar Games is facing a ransom deadline of Monday, April 14. Hacking group ShinyHunters claims to have breached the studio through Anodot, a third-party SaaS cloud-cost monitoring platform that Rockstar uses, and is now threatening to publish the stolen data if payment isn't received. With GTA 6 scheduled to launch on November 19, 2026, the timing could not be worse.

According to reporting by The Cybersec Guru, the compromised material potentially includes financial records, player spending data, geographic data, marketing timelines, and contracts with Sony, voice actors, and music labels. The group posted directly on the dark web: "Rockstar Games, your Snowflake instances were compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak, along with several annoying (digital) problems that'll come your way." Rockstar Games and Take-Two Interactive have not issued any public statement as of writing.

The technical route in is worth understanding, because it explains how a group can breach a company like Rockstar without ever touching a password. Snowflake confirmed to BleepingComputer this week that Anodot suffered a security incident affecting a small number of customers. ShinyHunters apparently used that access to pull Rockstar's authentication tokens, which bypasses Snowflake's login security entirely. Anodot's own website currently lists ongoing maintenance on its Frankfurt Cluster. So the breach didn't go through Rockstar's front door; it went through a side entrance Rockstar probably didn't think twice about.

This Is Not Rockstar's First Rodeo

In 2022, 18-year-old hacker Arion Kurtaj accessed Rockstar's internal Slack channel and leaked over 90 in-development GTA 6 gameplay videos, one of the most damaging leaks in the industry's history. Prosecutor Kevin Barry described the stolen material at the time as "highly confidential" given GTA's status as a billion-dollar franchise. Kurtaj also threatened to release source code unless Rockstar made contact, presumably to negotiate payment. The pattern here is almost identical.

ShinyHunters, for their part, are not amateurs. The group has been active since 2020 and has previously breached Microsoft, AT&T, Ticketmaster, SoundCloud, and the European Commission, typically by targeting third-party integrations and APIs rather than going after a company directly. In March, they claimed access to Salesforce data from over 400 companies and published data from 26 of them. This is a group with a track record of following through.

To be fair, there's no evidence at this stage that player passwords or payment details were accessed, so if your concern is your Rockstar Social Club account, the current risk appears to be corporate rather than personal. That said, enabling two-factor authentication on your Rockstar account right now costs you nothing and takes two minutes.

The real question is what happens Monday if Rockstar doesn't pay. Marketing timelines leaking this close to a November release would be damaging enough. Contracts with Sony, music labels, and voice actors going public would be a legal and PR disaster. And honestly, the fact that Rockstar has now been breached twice in four years, through two completely different attack vectors, is a conversation the studio needs to have loudly and publicly. Radio silence from Take-Two right now is not a good look. The GTA 6 OpenCritic page already shows a November 19 release date locked in. Whether that date survives whatever happens Monday is a different question entirely.

Want to see more? Catch all the latest gaming news, updates, and patch notes right here at XP Gained!