Rockstar has confirmed a third-party data breach in April 2026 but says only limited, non-material company information was accessed; the extortion details and data volumes come from the attackers and secondary reports. No source we read links the breach to GTA VI's game data or release date.
What is confirmed and what is not
| Item | Status | What is published | Source | Limit |
|---|---|---|---|---|
| Breach confirmed | Confirmed (Rockstar statement, via Help Net Security, 13 Apr 2026) | "We can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach. This incident has no impact on our organization or our players." | Help Net Security | We did not find the statement on a Rockstar page. |
| Attacker | Claimed (ShinyHunters) | A post on 11 April: "Rockstar Games! Your Snowflake instances were compromised thanks to Anodot.com. Pay or leak." Deadline 14 April. | Help Net Security | A criminal group's claim. |
| Entry route | Reported (Help Net Security) | Anodot, a cloud-cost monitoring platform, was used to extract authentication tokens to reach a Snowflake environment, without exploiting Snowflake itself. | Help Net Security | Reported, not confirmed by Rockstar. |
| Data volume | Not verified | — | — | Help Net Security says neither side specified volume or content. The '78.6 million records' figure appears in other outlets we did not read. |
| Ransom paid | Not verified | — | — | Not stated in the source we read. |
| GTA VI code, footage or player data | Not verified | — | — | The source says nothing about GTA VI data. Rockstar's statement says no impact on players. |
| Effect on 19 November launch | Not announced | — | — | No Rockstar statement linking the breach to the date. |
Related: GTA VI release date history, the Rockstar union recognition bid.
Sources: Help Net Security, 13 Apr 2026. Researched from Help Net Security, read 28 September 2026. Other security outlets (Bitdefender, Hackread, Mitiga, Deepwatch) appeared in search results and were not read, so their details are excluded.