The Deadline Passed. ShinyHunters Followed Through. 78 Million Records From Rockstar Games Are Now on the Dark Web. The Full Dataset Is Priced at $200,000. We Tracked This Supply Chain From Day One.

WHAT HAPPENED

ShinyHunters set April 14 as the deadline for Rockstar Games to pay or face public release of the data stolen through the Anodot supply chain compromise. Rockstar did not pay. ShinyHunters has begun publishing data on its dark web leak site.

Bitdefender reported on April 14 that ShinyHunters claims to have leaked more than 78 million records from analytics environments connected to Rockstar. The data appears to originate from Snowflake instances that were accessible through the stolen Anodot authentication tokens. Early analysis of the published data suggests it is focused on GTA Online and Red Dead Online game service telemetry and operational data. There is currently no confirmed evidence that player personal data, payment information, or GTA VI development materials are included in the initial leak, though the full dataset has not been independently analyzed.

The complete dataset is listed at $200,000 on ShinyHunters' marketplace. At that price point, the data is accessible to any funded threat actor, competitive intelligence operation, or secondary extortion group. The risk profile has fundamentally changed. When ShinyHunters was the only party with the data, the threat was extortion from a single actor. Now that the data is published, the exposure is permanent and the potential for downstream exploitation is unbounded.

THE COMPLETE TIMELINE

The Atarus blog has tracked this supply chain from initial breach to data publication across three posts. Here is the complete arc:

April 4: Anodot's status page shows all connectors down across all regions, including Snowflake, S3, and Amazon Kinesis. The breach has occurred but is not yet public.

April 7: BleepingComputer reports that over a dozen companies have suffered data theft after a SaaS integration provider was breached and authentication tokens stolen. Multiple sources identify Anodot as the compromised provider. ShinyHunters confirms it is behind the attacks.

April 9: Atarus publishes initial Anodot/Snowflake analysis. We document the attack chain, identify ShinyHunters as the actor, note the bank holiday timing, and warn that the victim list will continue to expand.

April 11: ShinyHunters posts Rockstar Games, Hallmark Cards, Amtrak, and McGraw Hill to its dark web leak site. April 14 ransom deadline set.

April 13: Atarus publishes Rockstar confirmation analysis. Rockstar confirms breach. We document the expanding victim list and warn about the deadline.

April 14: Deadline expires. ShinyHunters begins publishing data. 78 million records. Full dataset priced at $200,000.

WHAT CHANGES NOW

The shift from extortion to publication changes the threat model for every organization caught in the Anodot chain. During the extortion phase, the risk was that ShinyHunters would publish if the victim did not pay. Now that the data is public, the risk is that anyone with $200,000 or access to a torrent can use it.

For Rockstar specifically, the immediate concern is whether the published data contains information that could impact the GTA VI launch timeline, commercial partnerships with Sony and Microsoft, or marketing strategies. Rockstar's "non-material" characterization suggests the company does not believe so. ShinyHunters' $200,000 price tag suggests they believe the data has significant commercial value to someone.

For the broader set of Anodot customers who have not yet been named, this is the warning. ShinyHunters has demonstrated they will follow through on leak threats. If your organization uses Anodot and you have not already rotated credentials, audited Snowflake access logs, and inventoried third-party integration tokens, the window for proactive response is closing. Anodot and its parent Glassbox still have not responded to press inquiries.

WHAT THIS MEANS FOR THE ATARUS AUDIENCE

1. 1

   The Anodot supply chain is now a confirmed, documented, completed attack cycle: breach, token theft, downstream access, extortion, and publication. Use this as a case study for your own third-party risk assessments. If a single compromised SaaS analytics vendor can produce 78 million leaked records from one customer alone, what is the blast radius of your own integration dependencies?

2. 2

   Review every SaaS integration that holds tokens for your cloud data environments. This is the third time we have said this in five days because it is the single most important action. If you cannot produce an inventory of which vendors hold authentication tokens for your Snowflake, S3, BigQuery, or Salesforce instances, you cannot assess whether you are in a similar chain right now.

3. 3

   Implement token rotation policies and least-privilege scoping for all integration tokens. Long-lived, broadly scoped tokens stored by third-party vendors are the exact asset class that made this entire chain possible. Reducing token lifetime and restricting token scope would not have prevented the Anodot breach, but it would have limited what the attacker could access and for how long.