Vimeo Confirms Data Breach via Third-Party Analytics Vendor Anodot Vimeo has disclosed a data breach stemming from a security incident at Anodot, its third-party business analytics provider. The breach, attributed to the cybercriminal group ShinyHunters, exposed certain user and customer data, though no video content, login credentials, or payment information was compromised. According to Vimeo’s statement, the accessed data primarily included technical metadata, video titles, and, in some cases, customer email addresses. The company responded by revoking Anodot’s access, removing the integration, and enlisting third-party security experts to investigate. Law enforcement has also been notified. ShinyHunters listed Vimeo on its leak site on Tuesday, threatening to release stolen data unless a ransom was paid by Thursday. The group has been linked to a series of high-profile attacks in 2026, including breaches at McGraw Hill, ADT, and Rockstar Games with the latter also tied to the Anodot compromise. Reports suggest a broader supply-chain attack involving Anodot may have exposed data from multiple organizations. Google Threat Intelligence previously detailed ShinyHunters’ tactics, which rely on phishing schemes rather than software vulnerabilities. Despite law enforcement crackdowns in 2025, the group remains active, recently targeting Match Group (owner of Tinder, Hinge, and OkCupid) before shifting focus to its current campaign. The investigation into the Vimeo breach is ongoing.

Carnival Corporation Investigates Alleged Data Breach by ShinyHunters Extortion Group Carnival Corporation, the global cruise operator behind brands like Carnival Cruise Line, Princess Cruises, and Holland America Line, is probing a potential data breach after the ShinyHunters extortion group claimed to have stolen over 8.7 million records containing personally identifiable information (PII) and internal corporate data. On April 18, ShinyHunters listed Carnival on its "pay or leak" portal, threatening to release the data publicly if demands were not met by April 21, 2026. The group, known for high-profile breaches, typically gains access through phishing, credential theft, or cloud service exploitation. Carnival confirmed detecting suspicious activity linked to a phishing incident affecting a single user account. In a statement, the company acknowledged the breach, stating it had blocked unauthorized access and was working with security experts to assess the scope. While the investigation is ongoing, Carnival has not confirmed whether customer data was compromised. ShinyHunters’ claims remain unverified, but even limited account access could lead to significant exposure if linked to internal systems or cloud-based tools. Carnival, which serves millions of passengers annually, remains a prime target for cybercriminals seeking financial leverage through extortion. The incident underscores the rising threat of phishing-driven breaches in enterprise environments.

Medtronic Confirms Cyberattack by ShinyHunters, 9 Million Records Allegedly Stolen Medical device manufacturer Medtronic disclosed a cybersecurity breach last week, revealing that hackers accessed data within its corporate IT systems. The attack was claimed by the notorious extortion group ShinyHunters, which alleged the theft of over 9 million records containing personally identifiable information (PII) and terabytes of internal corporate data. Medtronic, the world’s largest medical device company by revenue ($33.5 billion) with operations in 150 countries, stated that the breach did not affect customer data, patient safety, or its manufacturing and distribution networks. The company emphasized that its product systems, hospital customer networks, and financial reporting infrastructure remained secure and separate from the compromised IT environment. ShinyHunters listed Medtronic as a victim on April 18, threatening to leak the stolen data unless the company engaged in ransom negotiations by April 21. The group’s listing has since been removed from its leak site, though the reason remains unclear. Medtronic is conducting an investigation to determine whether any personal data was exposed and has pledged to notify affected individuals if necessary. While the full scope of the breach is still under review, the incident highlights the persistent threat of data extortion attacks targeting major healthcare and technology firms.

ShinyHunters Breaches Rockstar Games, Leaks Data Ahead of Ransom Deadline The hacker group ShinyHunters claims to have stolen sensitive data from Rockstar Games, leveraging an AI-powered tool called Anodot to breach the company’s Snowflake-based data warehouse. The group, which previously targeted Ticketmaster, set an April 14, 2026 deadline for ransom demands, warning of further leaks and digital disruptions if unmet. However, they have already begun releasing portions of the stolen data. Initial leaks appear confined to GTA Online and Red Dead Online, with no evidence of compromised user personal data or details related to Grand Theft Auto VI. ShinyHunters explicitly stated in their message: “Your Snowflake instances were compromised thanks to Anodot.com. Pay or leak.” Rockstar Games acknowledged the breach in a statement, confirming that a “limited amount of non-material company information” was accessed but insisting the incident poses no risk to operations or players. The company emphasized that the breach does not affect its infrastructure or user experience.

ShinyHunters Claims Rockstar Games Breach via Anodot-Snowflake Integration Threat group ShinyHunters has listed Rockstar Games on its leak site, alleging a data breach through a compromised Anodot-Snowflake integration. The group has set an April 14 deadline for the studio to respond to its ransom demands. This incident follows Rockstar’s 2022 breach, where early Grand Theft Auto VI footage was leaked via a social engineering attack on its internal Slack. Unlike that incident orchestrated by an individual this latest threat appears to be part of a larger campaign targeting companies using cloud-based data warehousing and monitoring tools. ShinyHunters, known for high-profile breaches at Ticketmaster, AT&T, and Microsoft, allegedly bypassed Rockstar’s security by exploiting an automated integration with Anodot, a third-party cloud-cost monitoring platform. The group claims to have accessed Rockstar’s Snowflake environment which stores analytical data and player telemetry by harvesting authentication tokens from Anodot. This method allows attackers to bypass multi-factor authentication using long-lived service tokens, a tactic ShinyHunters has increasingly employed since late 2025. Rockstar is not the only target. The group has also listed Amtrak and McGraw Hill, claiming to have compromised over 100 million records through third-party Salesforce integrations. While Rockstar and its parent company, Take-Two Interactive, have yet to issue an official statement or regulatory disclosure, the breach if confirmed could expose sensitive corporate and player data. The April 14 deadline suggests the group may release the data if demands are unmet.

ShinyHunters Breaches Anodot, Compromises Snowflake Customer Data in Supply Chain Attack The ShinyHunters extortion group has claimed responsibility for a supply chain attack on Anodot, an AI-driven cloud analytics platform, resulting in the theft of authentication tokens for over a dozen Snowflake customer accounts. The breach, detected in mid-2024, mirrors a previous campaign where the group exploited weak security measures particularly the lack of multi-factor authentication (MFA) to infiltrate Snowflake environments. Hackers gained access to Anodot’s infrastructure, extracting tokens that allowed them to compromise Snowflake customer accounts. While they attempted to breach Salesforce accounts as well, their efforts were reportedly blocked. Snowflake confirmed "unusual activity" tied to a third-party integration but emphasized that its core systems remained uncompromised. The company locked down affected accounts and notified impacted customers. ShinyHunters, known for high-profile data theft and extortion, previously targeted Snowflake customers in early 2024, stealing sensitive data from major corporations, including AT&T, Ticketmaster, and Santander. The group has since resurfaced, claiming to have exfiltrated data from "dozens of companies" via the Anodot breach and is expected to pursue extortion demands. The incident underscores ongoing risks in third-party integrations and the critical need for robust authentication controls.

Zara Hit by ShinyHunters Data Breach Exposing 197K Customer Records Last month, global fashion retailer Zara was confirmed as a victim of a data breach linked to the cybercriminal group ShinyHunters. The incident resulted in the exposure of 197,000 unique email addresses, along with customer support records, product SKUs, and order IDs. According to reports, 60% of the leaked emails were already present in LinkedIn’s database, suggesting prior exposure in other breaches. The compromised data did not include financial information but could be leveraged for phishing or targeted attacks. ShinyHunters, known for selling stolen data on underground forums, has been linked to multiple high-profile breaches in recent years. The full extent of the breach’s impact remains under investigation, though the exposed records may increase risks for affected customers.

Rockstar Games Denies Major Breach Ahead of *GTA VI* Launch Rockstar Games has dismissed reports of a significant cyberattack targeting the upcoming release of Grand Theft Auto VI, set for November 19. Earlier claims suggested hackers had breached the company’s systems and demanded a ransom to prevent the leak of sensitive data. In a statement, Rockstar confirmed that a data breach did occur but it involved a third-party vendor, not its internal systems. The company emphasized that the incident has had no impact on its operations or players. No further details about the affected vendor or the nature of the exposed data were disclosed. The rumors surfaced amid heightened anticipation for GTA VI, one of the most highly anticipated games in history. While the breach appears contained, the incident underscores ongoing cybersecurity risks in the gaming industry, particularly for high-profile releases. Rockstar has not indicated whether law enforcement is investigating the matter.

Vimeo Confirms Data Breach via Third-Party Analytics Provider Video hosting platform Vimeo has disclosed a data breach stemming from a compromise at a third-party analytics vendor. The incident exposed user and customer data, including technical information and email addresses, though Vimeo confirmed that core systems and sensitive credentials remained unaffected. The breach highlights the risks of third-party dependencies in cybersecurity, as attackers leveraged access through an external provider to extract data. While the full scope of the exposure is still under investigation, Vimeo has not reported any direct impact on payment details or passwords. The incident follows a pattern of recent cyberattacks targeting supply chains, where vulnerabilities in vendor systems serve as entry points for threat actors. No specific timeline for the breach was provided, but the disclosure underscores the growing threat landscape for organizations reliant on external services.