GTA 6 maker Rockstar breached: Hackers demand 'pay or leak'

ISLAMABAD: Rockstar Games, the studio behind the forthcoming Grand Theft Auto VI, recently confirmed that hackers accessed company data through a third-party breach and issued a ransom ultimatum: pay up or face a public data dump.

The hacker group ShinyHunters claimed responsibility for the intrusion, setting April 14 as its deadline. By the end of the day, a GTA countdown account on X reported that stolen files had appeared on the dark web, including financial data detailing GTA Online's revenue.

Rockstar's response was measured. "We can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach," a company spokesperson said. "This incident has no impact on our organization or our players."

Cybersecurity outlet The CyberSec Guru reported that ShinyHunters exploited Anodot, a SaaS cloud-cost monitoring tool Rockstar uses, to penetrate the company's Snowflake data warehouse. The hackers did not crack Snowflake's encryption. Instead, they obtained authentication tokens from Anodot's system and used them as digital passkeys to access Rockstar's Snowflake instance.

"If you give a tool like Anodot broad read permissions on your Snowflake warehouse and that tool gets compromised, the data is gone. Snowflake isn't the weak link here; the integration policy is," The CyberSec Guru said.

Snowflake confirmed that a breach occurred on its platform, saying only a handful of customers were affected.

ShinyHunters sent a direct message to Rockstar: "Your Snowflake instances were compromised thanks to Anodot.com. Pay or leak. This is a final warning to reach out by 14 Apr 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision. Don't be the next headline. FINAL WARNING PAY OR LEAK."

ShinyHunters is a prolific group of English-speaking cybercriminals, believed to be teenagers, who specialize in data theft and extortion. The BBC, which spoke directly with the group, noted that they had previously claimed responsibility for a breach at the ticketing giant Ticketmaster. Since January, according to several media outlets, the group has expanded its reach amid a wave of SaaS data thefts, targeting companies including Panera Bread and Salesforce.

The stakes are considerable. GTA 6 is due for release on PlayStation 5 and Xbox Series X and S on Nov. 19, with a reported budget of approximately $3 billion. Leaked data could expose marketing timelines, unreleased trailers, or financial details, providing insider knowledge to betting markets tracking the game's release schedule.

Rockstar's framing of the accessed data as "non-material" suggests the company does not expect a damaging GTA 6 content leak six months before launch, nor any disruption to its release plans.

This is the third major security incident Rockstar has faced in recent years. In 2022, more than 90 videos and images from an early build of GTA 6 were leaked online by the hacking group Lapsus$, an intrusion that cost Rockstar nearly $5 million.

Take-Two CEO Strauss Zelnick called the incident "really frustrating and upsetting to the team." 

In December 2023, the first GTA 6 trailer leaked on X less than 24 hours before its scheduled premiere, forcing Rockstar to release it on YouTube ahead of schedule. "In terms of the leak, that's always disappointing for the team, but ultimately, I don't think it hurt us," Zelnick said at the time.

Whether the current breach carries similar consequences remains unclear. Rockstar has not indicated it will pay the ransom.