Security & Infrastructure Tools
Stolen Rockstar Games analytics data leaked by extortion gang
Rockstar Games confirms a data breach linked to an Anodot security incident, with the ShinyHunters extortion group leaking 78.6 million records said to come from Rockstar’s Snowflake analytics environment; the data reportedly includes internal analytics on online services, in-game revenue and player behavior for GTA Online and Red Dead Online, plus Zendesk support metrics, while Rockstar says the access was limited and the breach has no impact on players or the organization.

STOLEN ROCKSTAR GAMES ANALYTICS DATA LEAKED BY EXTORTION GANG
Overview
- A data breach linked to a recent security incident at Anodot has led to the leakage of what is described as Rockstar Games’ internal analytics.
- The ShinyHunters extortion gang claims to have published the stolen data on their data leak site, alleging access to Snowflake-hosted metrics.
- The exposed data is described as non-material analytics used to monitor online services, support tickets, and related operations.
What Was Alleged to Be Leaked
- The threat actors claim the dataset contains internal analytics used to monitor Rockstar’s online services and customer support workflows.
- Reported inclusions cover in-game revenue metrics, purchase metrics, and player behavior tracking.
- Additional data reportedly includes game economy metrics for Grand Theft Auto Online and Red Dead Online, as well as Zendesk support analytics.
Key Data Categories Reported
- In-game revenue and purchase metrics: figures used to track player spending and monetization trends.
- Player behavior data: metrics related to how players interact with online services and content.
- Game economy data: supply/demand indicators, in-game currency flows, and related balancing data for GTA Online and Red Dead Online.
- Support analytics: details from the Zendesk system used for customer support.
- Operational safeguards: mentions of fraud detection systems and anti-cheat testing data that were part of the referenced datasets.
Context and How It Happened
- The leak is tied to a larger data theft campaign centered on Anodot, a data anomaly detection company that integrates with various SaaS cloud platforms.
- According to the attackers, authentication tokens were stolen during a security incident involving Anodot, enabling access to connected Snowflake, S3, and Amazon Kinesis data stores.
- Snowflake reportedly detected unusual activity associated with a third-party integration and took steps to lock down affected accounts, followed by notifying customers.
- The third-party integration company in question was identified as Anodot, according to reports detailing the incident.
Industry and Incident Context
- The group behind the leak, ShinyHunters, has claimed responsibility for multiple breaches across various companies by utilizing compromised authentication tokens.
- Rockstar Games previously experienced a high-profile breach in 2022 associated with Lapsus$, which leaked GTA 6 gameplay videos and source code.
- The present incident is described as a data breach involving non-material company information but framed by attackers as part of a broader extortion-driven campaign.
Official Company Response
- Rockstar Games acknowledged a data breach but described the impact as limited to non-material information tied to a third-party incident.
- The company stated that there is no impact on the organization’s operations or on players.
- Commentary from Rockstar appears to have been provided to media outlets, with statements indicating the breach did not affect core services or player experience.
Operational Implications
- The leaked analytics data, if validated, could reveal how Rockstar monitors service health, revenue streams, and customer support performance.
- Access to internal fraud detection and anti-cheat testing data might inform lessons for other platforms about how analytics pipelines are secured and monitored.
- The incident highlights ongoing risks associated with third-party integrations and token-based authentication across cloud services.
Historical and Related Notes
- The event is referenced alongside other security incidents involving gaming and tech firms that have leveraged extortion for data exposure.
- Prior breaches serve as a reminder of how analytics and operational data can become a target in addition to customer PII or financial records.
- The broader narrative includes coverage of related breaches affecting SaaS partners and the cascading effects on connected services.
What to Watch For (Without Recommendations)
- Monitoring of whether further details emerge about the exact datasets impacted and the broader scope of the exposure.
- Scrutiny of how third-party integrations and token-based access are managed in large gaming ecosystems.
- Follow-up reports from credible security outlets on the veracity of the claimed 78.6 million records and the specific contents of the datasets.
- Any official clarifications from Rockstar Games or Anodot regarding the exact nature of the breach and any corrective actions taken.
Sections and Highlights Recap1) Breach genesis: link between Anodot security incident and token-based access to Snowflake environments.2) Data claims: internal analytics, revenue/purchase metrics, player behavior, economy data, Zendesk analytics.3) Threat actors: ShinyHunters extortion group asserting publication of stolen data.4) Company stance: Rockstar acknowledges a breach with no expected impact on players or operations.5) Historical ties: reference to the 2022 GTA 6 breach and ongoing extortion-focused cybercrime patterns.6) Security posture: emphasis on the risk surface created by third-party integrations and cloud-based data stores.
Closing Note
- The situation underscores the importance of securing analytics pipelines and access controls in large-scale online game ecosystems.
- As the story develops, additional validated information from multiple credible sources will determine the ultimate impact and the lessons learned for industry practitioners.