--- title: Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games description: Anodot's breach gave ShinyHunters stolen auth tokens to access Snowflake environments. Here's what happened, who's confirmed, and what to do now. image: https://vorlon.io/hubfs/anodot%20breach.png --- [Saas Security Blog](https://vorlon.io/saas-security-blog) > Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games # Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games [Anil Agrawal](https://vorlon.io/saas-security-blog/author/anil-agrawal) | Apr 14, 2026 [![Share on linkedin](https://vorlon.io/hubfs/ll-assets/Images/Icons/LinkedIn.svg) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fanodot-snowflake-breach-shinyhunters-data-theft%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://vorlon.io/hubfs/ll-assets/Images/Icons/X.svg) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fanodot-snowflake-breach-shinyhunters-data-theft%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fanodot-snowflake-breach-shinyhunters-data-theft%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Anodot+Breach+Exposes+Snowflake+Customer+Data%2C+Including+Rockstar+Games) [![Share on email](https://vorlon.io/hubfs/ll-assets/Images/Icons/envelope.svg) ](mailto:?subject=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fanodot-snowflake-breach-shinyhunters-data-theft%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fanodot-snowflake-breach-shinyhunters-data-theft%3Futm_medium%3Dsocial%26utm_source%3Demail) Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games 5:55 ![Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games](https://vorlon.io/hs-fs/hubfs/anodot%20breach.png?width=1200&height=820&name=anodot%20breach.png) ## The situation: What's reported and confirmed Over a dozen companies have suffered data theft attacks after a SaaS integration provider was breached and authentication tokens stolen. The majority of those attacks targeted Snowflake environments. Snowflake confirmed "unusual activity" in a small number of customer accounts linked to a specific third-party integration. Following the discovery, Snowflake launched an investigation, locked down potentially impacted accounts, and notified customers. Their stated position was this incident was not the result of a vulnerability or compromise within Snowflake's own systems. Snowflake subsequently confirmed to [BleepingComputer](https://www.bleepingcomputer.com/news/security/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach/) that the attacks stem from a security incident at Anodot, an AI-based analytics company acquired by Glassbox in November 2025. Anodot's status page has shown all connectors down across all geographic regions since the incident, affecting Snowflake, S3, and Amazon Kinesis integrations. Anodot and Glassbox have not responded publicly. ShinyHunters confirmed to BleepingComputer that they were behind the attacks, claiming to have stolen data from dozens of companies using authentication tokens from Anodot. The group also hinted they may have had access to Anodot for some time before acting. ## Rockstar Games confirmed as first named victim On April 13, ShinyHunters published what they claim is Rockstar Games data on their extortion site, stating: "Your Snowflake instances metrics data was compromised thanks to Anodot.com." [Rockstar confirmed the breach](https://www.bleepingcomputer.com/news/security/stolen-rockstar-games-analytics-data-leaked-by-extortion-gang/) to Kotaku, stating that "a limited amount of non-material company information was accessed in connection with a third-party data breach," adding that the incident has no impact on their organization or players. According to ShinyHunters, the leaked dataset contains more than 78.6 million records. The threat actors told BleepingComputer the data primarily consists of internal analytics used to monitor Rockstar's online services, including in-game revenue and purchase metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online. The dataset also appears to contain customer support analytics from Rockstar's Zendesk instance, along with references to fraud detection systems and anti-cheat model testing. Rockstar's characterization of the data as "non-material" is notable. The exposed records are operational and behavioral analytics, not credentials or player PII. Whether that framing holds under scrutiny will depend on how regulators and affected parties assess the sensitivity of that data in aggregate. Of the other alleged victims, only Payoneer has confirmed awareness of the Anodot incident, stating it was not impacted. Google's Threat Intelligence Group is tracking the situation but has not shared further detail. ## Why this attack path matters to defenders If the access path relies on stolen tokens, this is an integration-layer incident, not a product exploit. That distinction matters for how you scope your response. [Authentication tokens and non-human identities (NHIs)](https://vorlon.io/total-identity-security) are designed to be persistent and automated. Once compromised, they are difficult to distinguish from legitimate activity, which makes them an efficient, repeatable attack path. Vorlon's [*Agentic Ecosystem Security Gap: 2026 CISO Report*](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) found that 87% of surveyed CISOs cannot see sensitive data flows across their applications, and 27.4% reported experiencing breaches via compromised OAuth tokens or API keys. The gap isn't theoretical: it shows up in incidents like this one. ## The plausible attack chain Based on reported and confirmed information, the simplest evidence-aligned model of the attack is: - **Initial access:** Compromise of Anodot, a third-party SaaS integration provider. - **Credential harvesting:** Theft of legitimate downstream authentication tokens. - **Lateral movement:** Attempts to access customer environments using those tokens, confirmed heavily against Snowflake, with blocked attempts against Salesforce. - **Impact:** Downstream data theft across dozens of companies, followed by extortion pressure and, in Rockstar's case, public data publication after ransom refusal or non-response. The blocked attempts against Salesforce, which ShinyHunters attributed to AI detection, illustrate how a single integration foothold can expand into multi-system exposure quickly. The Rockstar publication shows the escalation path when victims don't pay: data goes public. ## Immediate steps Treat this as a prompt for a blast-radius exercise on your integrations and non-human identities. **Audit your ecosystem.** Inventory all third-party integrations connected to Snowflake and other sensitive data stores. Document the specific identities they run as and their effective permissions. **Enforce least privilege.** Rotate or revoke secrets for any high-privilege, uncertain, or dormant connectors. Reduce overly broad roles to strict least-privilege access. **Hunt for anomalies.** Look for abnormal data access behavior tied to integration identities: new IP addresses, off-hours activity, sudden query spikes, access to unusual warehouses or objects, large data exports. **Preserve your logs.** Retention gaps can erase the forensic evidence needed to validate scope and timeline. Lock down your logs early. ## How Vorlon helps Vorlon ingests API telemetry out-of-band and maps which third-party integrations and non-human identities have access to your sensitive data. It establishes behavioral baselines to surface abnormal integration activity consistent with token misuse, enabling targeted containment. Security teams can revoke or block a specific access path without broad disruption to operations.   About the author ![Anil Agrawal](https://vorlon.io/hs-fs/hubfs/Anil%20Agrawal%20headshot%20clear%20bg.png?width=120&height=120&name=Anil%20Agrawal%20headshot%20clear%20bg.png) [Anil Agrawal](https://vorlon.io/saas-security-blog/author/anil-agrawal) [Follow me on LinkedIn ](https://www.linkedin.com/in/anilagrawal15/) Anil Agrawal is a security researcher at Vorlon specializing in SOC optimization and has over eight years of experience in cybersecurity. Before joining Vorlon, he served as a Solutions Architect at Palo Alto Networks, where he designed advanced ... [Read Full Bio](https://vorlon.io/saas-security-blog/author/anil-agrawal) Blog tags - [Breach Response](https://vorlon.io/saas-security-blog/tag/breach-response) [![ShinyHunters Sidebar Ad](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/2026%20CISO%20Report%20Banner%20Ad%20Final.png?width=350&height=520&name=2026%20CISO%20Report%20Banner%20Ad%20Final.png) ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIFqhHbvMXr9sCtLg3SjGyxucXLDGAEZ6p7hVq%2FHj73J5jIl21ntspuXck0FDhLa5AoCVIiV6UPoFdmfyoCgk5gZhyQN0vNpJbQcKsyBPMqUuCsA79wUgKn%2BCq0jST2BYpRcl6MQO1nqRSUKrW04CR0pGt7umY8qquGOnnq3HJ0%2FYgVqp01i6ughr1Bd0ujJd4m2N8PUt6sJyfXCE46FwKHWOIg3dceObp%2BtoycGA%3D%3D&portalId=24426272) ### Related blogs [View all blogs](https://vorlon.io/blog) [![The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack](https://vorlon.io/hs-fs/hubfs/vercel%20breach%20blog.png?width=400&height=300&name=vercel%20breach%20blog.png) Breach Response ### The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack 7 min read Read More ](https://vorlon.io/saas-security-blog/vercel-incident-oauth-tokens-ai-supply-chain) [![Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected](https://vorlon.io/hs-fs/hubfs/mandiant%20research%20shinyhunters%20vishing.png?width=400&height=300&name=mandiant%20research%20shinyhunters%20vishing.png) Breach Response ### Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected 5 min read Read More ](https://vorlon.io/saas-security-blog/mandiant-research-shinyhunters-vishing-mfa) [![How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat](https://vorlon.io/hs-fs/hubfs/Gainsight%20Breach.webp?width=400&height=300&name=Gainsight%20Breach.webp) Breach Response ### How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat 9 min read Read More ](https://vorlon.io/saas-security-blog/the-gainsight-breach-and-saas-supply-chain-attacks) ## Featured resources [![CISO Report Resource Tile](https://vorlon.io/hs-fs/hubfs/CISO%20Report%20Resource%20Tile.webp?width=1548&height=1046&name=CISO%20Report%20Resource%20Tile.webp) WHITE PAPERS AND RESEARCH ### The Agentic Ecosystem SecurityGap: 2026 CISO Report Why 99% of Organizations Were Breached Through Their SaaS and AI Ecosystem Despite Record Security Investment Read more ](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) [![blog 451 why saas and ai are converged (1)](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png?width=329&height=222&name=blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png) SaaS Security ### 451 Research: Why AI and SaaS Security Are Converging 451 Research highlights how AI and SaaS security are converging. Learn why integrations, OAuth, and ecosystem-level risk now define enterprise security. Read more ](https://vorlon.io/saas-security-blog/451-research-ai-saas-security-convergence) [![datamatrix patent blog](https://vorlon.io/hs-fs/hubfs/datamatrix%20patent%20blog.png?width=1548&height=1046&name=datamatrix%20patent%20blog.png) ### DataMatrix™: Vorlon's Patented Approach to Agentic Ecosystem Security Vorlon's DataMatrix™ technology is now patented. Learn how this intelligent simulation engine secures the agentic ecosystem by mapping AI agents, SaaS integrations, and data in motion. Read more ](https://vorlon.io/saas-security-blog/datamatrix-vorlons-patented-technology) ## Get Proactive Security for Your Agentic Ecosystem Book a Demo [![Vorlon_Logo_Large_White](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/Vorlon_Logo_Large_White.png?width=139&height=33&name=Vorlon_Logo_Large_White.png) ](https://vorlon.io) ## Sign up for industry insights and Vorlon news Start Here - [The Agentic Ecosystem Security Gap](https://vorlon.io/problems-we-solve) - [The Agentic Ecosystem Signal to Action Layer](https://vorlon.io/our-solution) Platform - [Platform](https://vorlon.io/platform) - [AI Agent Runtime Security](https://vorlon.io/ai-runtime-security) - [Total Identity Security](https://vorlon.io/total-identity-security) - [Data-Centric SaaS Security](https://vorlon.io/data-centric-saas-security) - [Compliance Automation](https://vorlon.io/compliance-automation) - [Apps Directory](https://vorlon.io/app-directory) - [SecOps Integrations](https://vorlon.io/integrations) Company - [About](https://vorlon.io/about) - [Careers](https://vorlon.io/careers) - [Press Room](https://vorlon.io/press-room) - [Resources](https://vorlon.io/resources) - [Blog](https://vorlon.io/blog) Let's Connect - Talk to Sales ![soc-type-2](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/soc-type-2.jpg?width=105&height=50&name=soc-type-2.jpg)![aws logo cropped](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/aws%20logo%20cropped.png?width=50&height=50&name=aws%20logo%20cropped.png)![latio innovators on black](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/latio%20innovators%20on%20black.png?width=52&height=50&name=latio%20innovators%20on%20black.png)![2025-CRN-Stellar-Startups](https://vorlon.io/hs-fs/hubfs/Logo/2025-CRN-Stellar-Startups.webp?width=29&height=50&name=2025-CRN-Stellar-Startups.webp)![FS-ISAC-Seal_Affiliate_onblack](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/FS-ISAC-Seal_Affiliate_onblack.png?width=156&height=50&name=FS-ISAC-Seal_Affiliate_onblack.png) © 2026 Vorlon Inc. All rights reserved. - [Terms of Use](https://vorlon.io/terms-of-use) - [Privacy Policy](https://vorlon.io/privacy-policy) - [Sitemap](https://vorlon.io/sitemap) [![ClickCease](https://monitor.clickcease.com/stats/stats.aspx)](https://www.clickcease.com) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Anil Agrawal", "url" : "https://vorlon.io/saas-security-blog/author/anil-agrawal" }, "dateModified" : "2026-04-15T01:01:34.018Z", "datePublished" : "2026-04-15T01:00:43.000Z", "headline" : "Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games", "image" : [ "https://vorlon.io/hubfs/anodot%20breach.png" ], "mainEntityOfPage" : { "@id" : "https://vorlon.io/saas-security-blog/anodot-snowflake-breach-shinyhunters-data-theft", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vorlon.io/hubfs/Logo/Vorlon%20logo_two%20tone%20light.svg" }, "name" : "Vorlon Inc." } } ```