Ransomware victim disclosure
← All victimsRockstar Games
Claimed by shinyhunters · listed 1 month ago
Status timeline
- Listed
Apr 12, 2026
- Data leaked
At a glance
- Group
- shinyhunters
- Status
- Data leaked
- Country
- US
- Sector
- Technology
- Listed on leak site
- Apr 12, 2026
About the victim
AI dossier — public-source company profileRockstar Games is a major American video game developer and publisher, headquartered in New York City, known for flagship franchises such as Grand Theft Auto and Red Dead Redemption. The company operates globally with multiple development studios and is a subsidiary of Take-Two Interactive. It is one of the highest-revenue video game studios in the world.
- Industry
- Video Game Development & Publishing
- Employees
- 1001-5000
- Founded
- 1998
Attack summary
Severity: high — Confirmed exfiltration is claimed of cloud data warehouse metrics via a supply-chain vector (Anodot); Snowflake instances at a company of this scale typically contain significant business and potentially user-related data. The supply-chain compromise angle and threatened follow-on 'digital problems' elevate severity, though no PII at regulated scale is explicitly confirmed, keeping it at high rather than critical.ShinyHunters claims to have compromised Rockstar Games' Snowflake instance metrics data via a third-party analytics provider, Anodot.com, and is threatening to leak the data along with unspecified 'digital problems' unless a ransom is paid by 14 April 2026.
Data the group says was taken
AI dossier — extracted from the leak post- Snowflake instance metrics data
- Third-party analytics telemetry (via Anodot.com)
What the group claims
Your Snowflake instances metrics data was compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 11 Apr 2026 | Warning: FINAL WARNING PAY OR LEAK
Source
Indexed 1 month agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
