Threat reportSupply ChainTL-2026-4379
ShinyHunters Supply-Chain Compromise via Anodot Stolen Service Tokens Leads to Snowflake Data Theft (Rockstar Games)
ShinyHunters Supply-Chain Compromise via Anodot Stolen (TL-2026-4379), also tracked as Anodot supply-chain breach, is a high-severity supply-chain compromise, first published 2026-10-24. It is attributed to ShinyHunters with high confidence, affects Anodot (Glassbox) Anodot cloud analytics platform and data connectors, maps to 11 MITRE ATT&CK techniques (T1078.004, T1090.003, T1195), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 1ShinyHunters
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4379
- Threat ID
- TL-2026-4379
- Also known as
- Anodot supply-chain breach, Anodot token theft campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- ShinyHunters
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, gaming, news - media, finance, saas
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in ShinyHunters Supply-Chain Compromise via Anodot Stolen
Malware and tooling: Dataleak, DBeaver Ultimate, Tor - S0183
How ShinyHunters Supply-Chain Compromise via Anodot Stolen works
ShinyHunters breached SaaS analytics provider Anodot, stole the authentication tokens its customers use to connect to cloud data platforms, and used them to log in to downstream Snowflake environments (and attempted Salesforce) for data theft and extortion. No Snowflake vulnerability was exploited; over a dozen companies were hit, with Rockstar Games' data (reported as 78.6 million records) leaked after the April 14, 2026 ransom deadline.
Anodot, an AI-based cloud analytics and monitoring platform (owned by Glassbox), disclosed an incident on its public status page around April 4, 2026, when its Snowflake, Amazon S3 and Amazon Kinesis data connectors stopped functioning across all regions. On April 7, 2026 BleepingComputer reported that more than a dozen companies had suffered data-theft attacks after a SaaS integration provider was breached; the ShinyHunters extortion group stole authentication tokens that Anodot's customers use to reach their cloud data and used those tokens to pull data directly from customer cloud storage. The majority of the theft targeted Snowflake customers. Wiz's incident write-up notes evidence of prolonged access to the integrator's environment before the theft.
No Snowflake vulnerability or CVE was involved. The attackers authenticated with legitimate integration credentials, so the activity resembled the normal Anodot service account: database reconnaissance followed by SELECT-and-export operations that blended into regular administrative and integration traffic and delayed detection. Snowflake stated it detected unusual activity in a small number of customer accounts linked to a specific third-party integration, launched an investigation and locked down potentially impacted accounts out of caution. The threat actor also reportedly tried to use stolen tokens against Salesforce but was detected and blocked before succeeding.
Victims and extortion: Rockstar Games was the most prominent reported victim. ShinyHunters posted extortion demands on April 11, 2026 with an April 14 deadline, and published roughly 78.6 million records (corporate financial data, revenue splits, platform agreements and player/analytics metrics) on April 12 and after the deadline expired. Rockstar stated that only a limited amount of non-material company information was accessed and that players were not impacted. Vimeo separately disclosed on April 28, 2026 that about 119,000 user records (email addresses, video titles, technical metadata) were exposed via Anodot-linked access to Snowflake and BigQuery; per a third-party analysis, DBeaver Ultimate was used for database reconnaissance and data was compressed before exfiltration, with no lateral movement or privilege escalation observed beyond the integration's permissions. Payoneer publicly stated it was not impacted.
Detection and defensive focus: no public IOCs (IPs, domains, hashes) have been released. Mitiga associates ShinyHunters access with Mullvad VPN nodes, Tor exit nodes and unattributed cloud-provider IPs, and recommends detections for Snowflake external stage creation, database reconnaissance bursts on a new session, and service-account logins from anomalous IPs. Deepwatch additionally recommends watching for scripted user agents (Python, cURL, Postman), off-hours service account spikes and abnormal export volumes. Hardening: verify Anodot usage, revoke and reissue integration tokens, eliminate long-lived tokens, enforce least privilege, network policies/MFA or conditional access for service accounts, and baseline service account behavior. Severity is an analyst assignment; sources give no CVSS score.
MITRE ATT&CK techniques used in TL-2026-4379
Initial Access
T1078.004 Cloud Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Command and Control
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Collection
T1530 Data from Cloud Storage; T1560.001 Archive via Utility
Exfiltration
T1567 Exfiltration Over Web Service
Discovery
T1580 Cloud Infrastructure Discovery
Impact
Affected products and versions in ShinyHunters Supply-Chain Compromise via Anodot Stolen
- Anodot (Glassbox) — Anodot cloud analytics platform and data connectors (Snowflake, S3, Kinesis)
Vulnerable versions: SaaS service as operated through at least April 2026 - Snowflake — Snowflake customer accounts with Anodot integration (misuse of valid tokens, not a platform vulnerability)
Remediation for ShinyHunters Supply-Chain Compromise via Anodot Stolen
Immediate actions
- Determine whether Anodot integrations exist in your Snowflake, BigQuery, S3, Kinesis or Salesforce environments
- Revoke and reissue all authentication tokens and credentials issued to Anodot or other third-party integrations
- Review Snowflake login and query history for the integration service account for anomalous source IPs, new sessions followed by reconnaissance bursts, bulk SELECT/export activity and external stage creation
- Brief legal and executive teams on potential extortion contact
Workarounds
- Restrict integration service accounts to known source IP ranges with network policies
- Enforce MFA or conditional access for automated accounts where supported
- Disable or remove the Anodot integration until the provider's remediation is confirmed
Longer-term hardening
- Baseline service account permissions and activity and alert on deviations
- Eliminate long-lived tokens in favor of automatically rotated credentials
- Apply least privilege to third-party SaaS access in cloud data warehouses
- Strengthen third-party risk management and monitor integrator security posture
- Monitor egress and export volumes from trusted service accounts
Timeline of ShinyHunters Supply-Chain Compromise via Anodot Stolen
- Anodot's public status page reports a broad outage with Snowflake, S3 and Kinesis connectors down across all regions, the first public sign of the breach; stolen tokens were used against customers around this time.
- BleepingComputer reports more than a dozen companies hit by data-theft attacks after a SaaS integration provider breach; Snowflake says it locked down potentially impacted customer accounts; Wiz and RH-ISAC publish write-ups. Attempted pivot to Salesforce reportedly detected and blocked.
- Updates to reporting confirm Anodot as the breached third party (BleepingComputer April 8-9 updates).
- ShinyHunters announces the Rockstar Games breach and posts extortion demands with an April 14 deadline.
- ShinyHunters publishes about 78.6 million Rockstar-related records after ransom demands go unpaid.
- TechCrunch reports over a dozen companies facing extortion; Rockstar says only a limited amount of non-material information was accessed and players are not impacted.
- Ransom deadline expires; stolen data continues to be released.
- Vimeo discloses a breach of about 119,000 user records via its Anodot analytics integration (Snowflake and BigQuery) and removes the integration.
- Mitiga updates its analysis of the ShinyHunters, Snowflake and Rockstar incident.
Sources cited for ShinyHunters Supply-Chain Compromise via Anodot Stolen
- ShinyHunters, Snowflake and Rockstar: Another SaaS Leads to Compromise (Mitiga)
- Snowflake customers hit in data theft attacks after SaaS integrator breach (BleepingComputer)
- Hack at Anodot leaves over a dozen breached companies facing extortion (TechCrunch)
- Stolen SaaS integration tokens enable data theft across Snowflake environments (Wiz Threat Center)
- CA-A-26-006: ShinyHunters breaches Rockstar Games via third-party cloud integration (Deepwatch)
- Active Data Theft Campaign Targeting Snowflake Customers via Anodot Third-Party SaaS Integration Breach (RH-ISAC)
- Vimeo data breach 2026: ShinyHunters exploit Anodot integration to expose 119,000 user records (Rescana)
- Third-party integration tool Anodot data breach hits Snowflake customers (TechRadar)
- Rockstar Games confirms breach after ShinyHunters leaks stolen analytics data (Bitdefender)
- Rockstar Games hit with ransom demand after third-party breach (TechSpot)
Detection coverage for TL-2026-4379
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4379 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.