ShinyHunters Just Hacked Rockstar Through A Supplier – Every Business Using Third-Party Software Should Pay Attention

If ShinyHunters sends you a ransom note, you’ve had a bad day. Rockstar Games is having one.

According to reporting from The Register, the hacking collective behind some of the most high-profile data breaches of recent years has claimed a successful attack on the studio behind Grand Theft Auto, with a ransom deadline set for 14 April 2026.

The attackers didn’t break into Rockstar’s own infrastructure to do it. They walked through a door left open by Anodot, a third-party cloud analytics vendor Rockstar used for monitoring cloud costs and performance data.

Rockstar has confirmed that a limited amount of non-material company information was accessed and that player data and live game services were unaffected. It hasn’t disclosed the exact nature of what was taken or whether any ransom demand has been met. What it has confirmed, however, is enough to make the point: one of the best-resourced studios in gaming had its data compromised because an attacker found a weaker door in the supply chain and used it.

That detail is the one every founder building on cloud services and third-party software stacks should contemplate.

Same Group, Same Playbook, Different Target

ShinyHunters has been making headlines for years, and the pattern is consistent.

The group has previously been linked to notable breaches at Ticketmaster, Santander and AT&T, among others. A recurring characteristic of their attacks is exploiting third-party cloud infrastructure rather than attacking targets directly. The Aura breach earlier this year, which exposed around 900,000 records, also involved ShinyHunters targeting a vendor relationship rather than the company’s core systems.

In the Rockstar case, the entry point was Anodot, a platform used for cloud analytics and cost monitoring. This bears relevance for a specific reason: analytics and monitoring tools are often given wide read access to cloud environments precisely because they need visibility across multiple systems to do their job – that makes them a valuable target. Compromise the analytics layer and you can potentially see a great deal of what the company sees, without ever touching the production systems themselves.

Rockstar isn’t the only business exposed to this. A 2021 PwC survey found that only around 40% of organisations comprehensively assess third-party and supply chain cyber risk, despite this being one of the most consistently exploited attack vectors.

The attack surface created by SaaS tools and cloud integrations is often larger than the one created by a company’s own code, and it receives far less scrutiny.

Your Vendors Are Part Of Your Attack Surface Whether You Like It Or Not

Third-party tools exist in a mental category, somewhere between ‘vendor problem’ and ‘not our responsibility’. Most startups think about security in terms of their own stack: their application code, their database, their infrastructure. The Rockstar breach illustrates why that framing is wrong.

When you give a SaaS vendor access to your cloud environment, even read-only access for monitoring purposes, you’re extending your security perimeter to include theirs. Their misconfiguration becomes your breach, their compromised credentials become your incident, and their incident response plan, or lack of one, becomes your problem to manage, including your obligations under UK GDPR and, for businesses operating in the EU, the NIS-2 Directive.

The challenge is that modern startups typically have dozens of third-party integrations touching their systems – analytics platforms, CRMs, payment processors, logging tools, CI/CD pipelines, identity providers – each one is a potential entry point. Most are assessed at onboarding and then rarely revisited.

The space between ‘we checked them at onboarding’ and ‘we haven’t looked since’ is exactly where attackers look for opportunities.

The Practical Bit For Founders

Here are three areas to address before an incident makes them urgent.

The first is vendor inventory and access review. Maintain an up-to-date list of every third party with access to your data or systems, what level of access they have and when that access was last reviewed. Any vendor with broad cloud access, like an analytics platform or a monitoring tool, warrants particular scrutiny. Ask for evidence of SOC 2 or ISO 27001 certification, penetration test summaries and incident response procedures. If a vendor can’t provide these, that tells you something important.

The second is limiting what any single integration can see or do. Cloud-native controls, strict IAM policies, VPC segmentation and isolated build environments all help limit how far the damage can spread if a third-party tool is compromised. The goal is to ensure that if vendors fail, the damage stays contained rather than cascading across the rest of your infrastructure.

The third is making sure your incident response plan explicitly covers third-party-led breaches. Many incident response plans focus on direct attacks against company systems. Rockstar’s situation is a reminder that you can be breached even when your own infrastructure is secure. Your plan should cover how you’d detect a vendor-side compromise, how you’d respond, and what your legal and communications obligations are under UK GDPR when the breach originates outside your own systems.

Don’t Pay The Ransom

On the ransom demand specifically: law enforcement and security authorities consistently advise against paying. Payment neither guarantees the deletion of stolen data nor prevents the group from attacking again or selling the data regardless.

ShinyHunters has a history of multiple monetisation attempts on the same data .The calculus for UK businesses is clear: engage your incident response team, notify the ICO within 72 hours where required under UK GDPR, and work with cybersecurity specialists, not the attackers.

The Rockstar breach is a reminder, although a frustrating one, that supply chain security is no longer a problem only large enterprises need to worry about. Attackers follow the path of least resistance. For growing businesses building on complex third-party stacks, that path largely runs through the tools they’ve integrated and forgotten about rather than the systems they actively protect.