The hacking group ShinyHutors has released a massive cache of stolen data belonging to Rockstar Games following the developer's refusal to pay a ransom. The leak, made available on the dark web on April 13, includes more than 78.6 million records containing internal analytics and financial metrics.
ShinyHunters claims the breach occurred via an exploit related to Anodot.com, a data anomaly detection company. According to reports from BleepingComputer, the threat actors used stolen authentication tokens from Anodot to access Rockstar's Snowflake, S3, and Amazon Kinesis environments.
In a message posted on their website, the group stated: "Your Snowflake instances metrics data was compromised thanks to Anodot.com. We do not operate a Telegram channel and this data was never for sale like reported on X (formerly Twitter) for $200k. It is now leaked. How does it feel to be the headline?"
While the leak contains significant financial data, it does not appear to include Grand Theft Auto 6 source code, assets, or player personal information. Kotaku reports that the breach primarily targeted metrics information from a third-party cloud server provider rather than Rockstar's internal computers.
Financial metrics and player behavior
Leaked datasets provide a detailed look at the revenue streams for Rockstar's flagship titles. According to data shared by user Lexiture on the GTA Forums and verified by Kotaku, GTA Online generated an average of $1,319,322 in daily revenue between September 2025 and April 2026.
Weekly revenue for GTA Online fluctuated between $4,799,298 and $27,889,761 during the same period. In contrast, Red Dead Online averaged roughly $507,193 in weekly revenue from September 2025 to April 2026.
The leaked files also reveal platform-specific spending habits. Data indicates that the PlayStation 5 leads in weekly bookings with $4,486,346, followed by the Xbox Series X at $1,867,947, and the PlayStation 4 at $973,308. The PC platform recorded the lowest weekly bookings at $264,273.
Additional analytics found in the leak include player behavior tracking, game economy data, and customer support metrics from Rockstar's Zendesk instance. BleepingComputer noted the presence of references to fraud detection systems and anti-cheat model testing within the files.
One significant finding suggests that only about 4 percent of GTA Online's active player base contributes to the game's massive revenue through purchases like Shark Cards and GTA+.
Rockstar Games has downplayed the severity of the incident. In a statement shared with Kotaku, the company confirmed the breach but stated: "We can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach. This incident has no impact on our organization or our players."
Snowflake confirmed to BleepingComputer that it detected unusual activity affecting a small number of customer accounts tied to the Anodot third-party integration and subsequently locked down the affected accounts.
