Key Pointers –
- ShinyHunters leaked Rockstar’s data on April 13, a day before the deadline after the studio refused to pay the ransom.
- The 78M records contain GTA Online and Red Dead Online revenue metrics, player spending habits & more.
- This did not include any data, assets from GTA VI or player passwords.
On April 11, hacking group ShinyHunters posted a ransom notice on its dark website claiming it had accessed Rockstar’s internal cloud data through Anodot, a third-party analytics tool the studio uses to monitor cloud costs. For this, the hackers asked for a ransom to be paid for April 14, or face a public leak.
Rockstar confirmed the breach the same day, calling it “non-material” and saying it had “no impact on our organisation or our players.” On April 13, however, ShinyHunters posted the data publicly anyway, and replied, “How does it feel to be the headline?“
What Data Was Actually Leaked
Thankfully no GTA VI source code was released. All character assets, player passwords or payment details were safe. Instead the hackers got hold of Rockstar’s internal analytics, with 78M of GTA Online and Red Dead Online metrics. These included :-
- Revenue figures
- Player behaviour tracking
- In-game economy balancing
- Fraud detection data
- Spending breakdowns by country
GTA Forums users have already started pulling these numbers. According to the data, GTA Online brought in approximately $1.3M per day over a recent six-month period, which translates to roughly $10M per week. Between 2014 and 2024, Rockstar made over $5B from Shark Card sales alone.
To add to this context – only 4% of GTA Online players are spending money. A tiny fraction of the player base is responsible for Rockstar’s entire revenue stream.
Xbox Series and Xbox One is lacking behind PS4 for GTA Online in terms of player counts.
— ben (@videotech) April 13, 2026
Source: https://t.co/xFIk7Ys7Sh pic.twitter.com/LlVJZTVSWu
Comparatively, Red Dead Online makes far, far less, according to those who have seen the data. That gap explains a lot about why Rockstar has invested so differently in both games post-launch.
However, Rockstar is yet to comment or confirm these stats on the data has been received by Rockstar. However, Kotaku’s report has this confirmed the figures being shared publicly against those with direct access to the files.
How Rockstar Got Hacked?
ShinyHunters did not crack Rockstar’s servers directly. They did not breach Snowflake either. Instead they targeted Anodot, a cloud cost monitoring platform the video game company used as a third-party integration. Attackers stole authentication tokens from Anodot’s systems that gave them a free pass to access Rockstar’s connected Snowflake environment.
Notoriously known to use the same supply chain method, ShinyHunters have previously targeted Cisco and TELUS in recent weeks. Based on the patterns, these attacks by the hackers seem to be a part of a broader sweep than a Rockstar focused targeted hit.
2026 vs 2022: How Different Were Both Rockstar Breaches
This is the second major breach to hit Rockstar in four years. Earlier in 2022, a teenager accessed the studio’s internal Slack through a hotel television and an Amazon Firestick, dumping 90 clips of early GTA VI development footage. He was later given an indefinite hospital order. That breach was indeed a targeted, manual intrusion. This one is different, methodical, automated, and a part of a campaign hitting multiple companies through the same vulnerability.
Recently, Rockstar also dismissed over 30 employees in the UK for allegedly discussing confidential information in a public forum. These terminations were widely criticised, with some of the affected staff saying they were being punished for organising.
The studio that built its reputation on satirising corporate excess and institutional failure keeps finding itself generating that exact kind of story.
Also read: Samson Is Finally Here But Would Fans Like It As An Alternative To GTA?
What’s Next for Rockstar
GTA VI launches November 19, 2026 on PS5 and Xbox Series X|S. Nothing in this leak affected the game development directly. Game’s source code, marketing materials and release plan details were all safe.
Take-Two Interactive’s stock dropped over 6% in pre-market trading when the news first broke. It has since then rebounded. The revenue data is now public and will be cited, analysed, and argued about for weeks. Rockstar’s decision not to pay was the right call by security standard. But the data is out regardless.
