Anodot

Summary

Hackers infiltrated the business monitoring provider Anodot and exfiltrated authentication tokens that its customers use to access cloud‑stored data. Using those credentials, the attackers entered the cloud environments of more than a dozen of its clients, copying large volumes of information and threatening to publish it unless a ransom was paid. The ShinyHunters group claimed responsibility, leveraging social engineering tactics to obtain the initial foothold. One cloud platform responded by suspending access for affected accounts after detecting anomalous activity, and at least one well‑known game developer confirmed that only non‑essential data was viewed. The incident highlights how compromises of third‑party service providers can cascade into widespread data exposure and extortion attempts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On April 4, 2026, Anodot’s data connectors stopped working, preventing its customers from accessing their cloud‑stored data, which the company noted on its status page as the start of the incident. Hackers subsequently gained access to Anodot’s systems and stole authentication tokens that its customers use to connect to their cloud storage. Using those stolen tokens, the attackers accessed the cloud environments of Anodot’s clients and extracted large volumes of data. Snowflake, one of the cloud storage providers used by Anodot customers, detected unusual activity in some data stores and responded by cutting off access for the affected accounts. The breach was first reported by Bleeping Computer and later covered by BBC News and other outlets.

The attackers are believed to have compromised data from at least a dozen companies that rely on Anodot for business monitoring. One of the named victims is Rockstar Games, the publisher of the Grand Theft Auto and Max Payne franchises, according to reporting by Kotaku. A Rockstar spokesperson told TechCrunch that only a limited amount of non‑material company information was accessed and that the incident had no impact on the organization or its players. The spokesperson also referenced Rockstar’s earlier breach in 2022, when hackers stole and published an early trailer for Grand Theft Auto VI. Neither Snowflake nor Glassbox, the parent company of Anodot, provided comments when approached for comment by TechCrunch.

ShinyHunters, the hacking group claiming responsibility, is described as a largely English‑speaking crew known for stealing data and extorting victims, often using social engineering tactics such as impersonating IT help desk staff to obtain credentials. The group focuses on companies that store large amounts of data in cloud storage and has, in the past year, targeted similar service providers like Anodot, Gainsight, and Salesloft to harvest passwords and tokens. In some previous incidents, tokens obtained from these services have enabled the hackers to breach additional downstream companies. ShinyHunters threatened to release the stolen Anodot‑derived data unless their ransom demands were met, a tactic consistent with their prior extortion campaigns. The incident was covered by Zack Whittaker, security editor at TechCrunch, who can be reached via Signal at zackwhittaker.1337 or email at [email protected].

Sources

Sources available to members: 1 source.