# ShinyHunters Supply-Chain Compromise via Anodot Stolen Service Tokens Leads to Snowflake Data Theft (Rockstar Games)

> ShinyHunters breached SaaS analytics provider Anodot, stole the authentication tokens its customers use to connect to cloud data platforms, and used them to log in to downstream Snowflake environments (and attempted Salesforce) for data theft and extortion. No Snowflake vulnerability was exploited; over a dozen companies were hit, with Rockstar Games' data (reported as 78.6 million records) leaked after the April 14, 2026 ransom deadline.

- **Published:** 2026-10-24T11:52:51Z
- **Last reviewed:** 2026-10-24T11:52:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4379
- **ID:** TL-2026-4379
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Anodot, an AI-based cloud analytics and monitoring platform (owned by Glassbox), disclosed an incident on its public status page around April 4, 2026, when its Snowflake, Amazon S3 and Amazon Kinesis data connectors stopped functioning across all regions. On April 7, 2026 BleepingComputer reported that more than a dozen companies had suffered data-theft attacks after a SaaS integration provider was breached; the ShinyHunters extortion group stole authentication tokens that Anodot's customers use to reach their cloud data and used those tokens to pull data directly from customer cloud storage. The majority of the theft targeted Snowflake customers. Wiz's incident write-up notes evidence of prolonged access to the integrator's environment before the theft.

No Snowflake vulnerability or CVE was involved. The attackers authenticated with legitimate integration credentials, so the activity resembled the normal Anodot service account: database reconnaissance followed by SELECT-and-export operations that blended into regular administrative and integration traffic and delayed detection. Snowflake stated it detected unusual activity in a small number of customer accounts linked to a specific third-party integration, launched an investigation and locked down potentially impacted accounts out of caution. The threat actor also reportedly tried to use stolen tokens against Salesforce but was detected and blocked before succeeding.

Victims and extortion: Rockstar Games was the most prominent reported victim. ShinyHunters posted extortion demands on April 11, 2026 with an April 14 deadline, and published roughly 78.6 million records (corporate financial data, revenue splits, platform agreements and player/analytics metrics) on April 12 and after the deadline expired. Rockstar stated that only a limited amount of non-material company information was accessed and that players were not impacted. Vimeo separately disclosed on April 28, 2026 that about 119,000 user records (email addresses, video titles, technical metadata) were exposed via Anodot-linked access to Snowflake and BigQuery; per a third-party analysis, DBeaver Ultimate was used for database reconnaissance and data was compressed before exfiltration, with no lateral movement or privilege escalation observed beyond the integration's permissions. Payoneer publicly stated it was not impacted.

Detection and defensive focus: no public IOCs (IPs, domains, hashes) have been released. Mitiga associates ShinyHunters access with Mullvad VPN nodes, Tor exit nodes and unattributed cloud-provider IPs, and recommends detections for Snowflake external stage creation, database reconnaissance bursts on a new session, and service-account logins from anomalous IPs. Deepwatch additionally recommends watching for scripted user agents (Python, cURL, Postman), off-hours service account spikes and abnormal export volumes. Hardening: verify Anodot usage, revoke and reissue integration tokens, eliminate long-lived tokens, enforce least privilege, network policies/MFA or conditional access for service accounts, and baseline service account behavior. Severity is an analyst assignment; sources give no CVSS score.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1580 Cloud Infrastructure Discovery
- T1530 Data from Cloud Storage
- T1560.001 Archive via Utility
- T1090.003 Multi-hop Proxy
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [ShinyHunters, Snowflake and Rockstar: Another SaaS Leads to Compromise (Mitiga)](https://www.mitiga.io/blog/shinyhunters-snowflake-and-rockstar-another-saas-leads-to-compromise)
- [Snowflake customers hit in data theft attacks after SaaS integrator breach (BleepingComputer)](https://www.bleepingcomputer.com/news/security/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach/)
- [Hack at Anodot leaves over a dozen breached companies facing extortion (TechCrunch)](https://techcrunch.com/2026/04/13/hack-at-anodot-leaves-over-a-dozen-breached-companies-facing-extortion/)
- [Stolen SaaS integration tokens enable data theft across Snowflake environments (Wiz Threat Center)](https://threats.wiz.io/all-incidents/stolen-saas-integration-tokens-enable-data-theft-across-snowflake-environments)
- [CA-A-26-006: ShinyHunters breaches Rockstar Games via third-party cloud integration (Deepwatch)](https://www.deepwatch.com/labs/ca-a-26-006-shinyhunters-breaches-rockstar-games-via-third-party-cloud-integration/)
- [Active Data Theft Campaign Targeting Snowflake Customers via Anodot Third-Party SaaS Integration Breach (RH-ISAC)](https://rhisac.org/?p=17143)
- [Vimeo data breach 2026: ShinyHunters exploit Anodot integration to expose 119,000 user records (Rescana)](https://www.rescana.com/post/vimeo-data-breach-2026-shinyhunters-exploit-anodot-integration-to-expose-119-000-user-records-via-snowflake-and-bigquery)
- [Third-party integration tool Anodot data breach hits Snowflake customers (TechRadar)](https://www.techradar.com/pro/security/snowflake-customers-suffer-data-theft-attacks-after-third-party-issue-company-confirms-unusual-activity)
- [Rockstar Games confirms breach after ShinyHunters leaks stolen analytics data (Bitdefender)](https://www.bitdefender.com/en-us/blog/hotforsecurity/rockstar-games-data-breach)
- [Rockstar Games hit with ransom demand after third-party breach (TechSpot)](https://techspot.com/news/112038-rockstar-games-hit-ransom-demand-after-third-party.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4379