Rockstar Confirms Limited Data Breach After ShinyHunters Claims 78.6 Million Records Leaked

Summary

Rockstar confirmed limited company information was accessed after ShinyHunters claimed to leak more than 78.6 million records, allegedly accessed using tokens stolen in an Anodot incident. Rockstar said players and operations were unaffected.

Key points

ShinyHunters claimed to have published more than 78.6 million records tied to Rockstar Games; the record count and contents are not independently confirmed in the article.
The group alleged it used authentication tokens stolen during a security incident at Anodot to access connected Snowflake, S3, and Amazon Kinesis data.
Rockstar confirmed that a limited amount of non-material company information was accessed and said the incident had no impact on the company or its players.
The reportedly exposed data includes internal revenue and purchase metrics, player behavior and game-economy analytics, and Zendesk support analytics.
A file list reviewed by BleepingComputer referenced fraud-detection systems and anti-cheat model testing.
Snowflake said it detected unusual activity affecting a small number of customer accounts tied to a third-party integration, locked affected accounts, and notified customers; it later identified the integration company as Anodot.

Article Details

Victim Organization: Rockstar Games
Incident Type: Data breach involving authentication tokens reportedly stolen during a security incident at Anodot and used to access data in connected Snowflake, S3, and Amazon Kinesis environments.
Data Types Exposed: Internal analytics, including in-game revenue and purchase metrics
Player behavior and game-economy data for Grand Theft Auto Online and Red Dead Online
Zendesk customer support analytics and support tickets
Fraud-detection and anti-cheat model testing data
Affected Records: ShinyHunters claimed the published data contained more than 78.6 million records; this figure was not independently confirmed in the article.
Affected Data Size: Not disclosed
Operational Impact: Rockstar stated that the incident had no impact on its organization or players. Snowflake said it locked affected customer accounts and notified customers.
Ransom Or Extortion: ShinyHunters published the data on its extortion site. No ransom demand was reported.
Claim Status: confirmed

Threat Actors

ShinyHuntersThe group claimed responsibility for attacks using tokens stolen during the Anodot security incident and published data it said belonged to Rockstar Games. Rockstar confirmed that a limited amount of non-material company information was accessed, but the group’s claimed record count and the full scope of the published data were not independently confirmed.

Vendors

AmazonAs first reported by BleepingComputer, the threat actors stole authentication tokens from the service and used them to access customer data stored in connected Snowflake, S3, and Amazon Kinesis instances.AnodotRockstar Games confirmed a limited data breach after the ShinyHunters extortion gang published what it says are over 78.6 million records obtained via authentication tokens stolen during a security incident at Anodot.SnowflakeThe leaked datasets reportedly include internal Snowflake and Zendesk analytics such as in-game revenue and purchase metrics, player behavior tracking, support tickets, and anti-fraud/anti-cheat testing data.ZendeskThe leaked datasets reportedly include internal Snowflake and Zendesk analytics such as in-game revenue and purchase metrics, player behavior tracking, support tickets, and anti-fraud/anti-cheat testing data.

Products

Amazon KinesisAs first reported by BleepingComputer, the threat actors stole authentication tokens from the service and used them to access customer data stored in connected Snowflake, S3, and Amazon Kinesis instances.Grand Theft Auto OnlineThis data allegedly includes in-game revenue and purchase metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online.Red Dead OnlineThis data allegedly includes in-game revenue and purchase metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online.S3Attackers allege they used authentication tokens stolen from Anodot to access Snowflake, S3, and Kinesis instances.SnowflakeThe leaked datasets reportedly include internal Snowflake and Zendesk analytics such as in-game revenue and purchase metrics, player behavior tracking, support tickets, and anti-fraud/anti-cheat testing data.ZendeskThe leaked datasets reportedly include internal Snowflake and Zendesk analytics such as in-game revenue and purchase metrics, player behavior tracking, support tickets, and anti-fraud/anti-cheat testing data.