78.6 Million Records: Gaming Industry Player Data in 2026

ShinyHunters leaked 78.6 million records from Rockstar Games in April 2026, according to multiple cybersecurity outlets that reviewed the leaked files, after the group compromised Anodot, a third-party cloud analytics platform Rockstar uses to monitor GTA Online and Red Dead Online. It is the largest confirmed gaming-industry data exposure of the year, and it lands in an industry where the player base skews younger than almost any other consumer category, and where regulators have handed out nine-figure penalties for mishandling exactly that kind of data.

How did 78.6 million records leak from Rockstar Games?

ShinyHunters extracted authentication tokens from Anodot, an AI-powered cloud cost monitoring tool Rockstar uses for infrastructure analytics, then used those tokens to impersonate a legitimate internal service and reach Rockstar's connected Snowflake data warehouse. The stolen archive, 25 files totaling 7.54GB, was published on the group's leak site on April 14 and 15, 2026, after Rockstar declined to pay a ransom the group had demanded by an April 14 deadline.

Rockstar has said the incident did not touch player-facing systems: "We can confirm that a limited amount of non-material company information was accessed in connection with a third-party data breach," a company spokesperson said. The leaked dataset is described as multi-domain analytics data rather than player account credentials, but the incident still illustrates a pattern seen across the legal sector's largest recent breaches too: attackers reaching a company's core systems through a smaller third-party vendor rather than a direct exploit of the target itself.

How much has the FTC fined game companies over player data?

Epic Games paid $520 million to settle two separate FTC actions in December 2022: a $275 million penalty for violating COPPA by collecting personal data from Fortnite players under 13 without verified parental consent, still the largest penalty ever imposed for breaking an FTC rule, and a separate $245 million to refund players charged through deceptive in-game purchase interfaces. Cognosphere, the company behind Genshin Impact and doing business as HoYoverse, paid $20 million in January 2025 to settle FTC charges that it collected children's data without consent and misrepresented loot box odds to players.

Figure 1: Regulatory penalties against gaming companies tied to player data and children's privacy, 2022 to 2026. Sources: FTC press releases, West Virginia and South Dakota Attorney General settlement announcements.

Roblox has faced a different kind of regulatory pressure: not FTC fines over data collection mechanics, but state attorney general lawsuits over child-safety failures on the platform itself. West Virginia's attorney general announced an $11 million settlement with Roblox in 2026, and South Dakota's settlement, announced in July 2026, totals roughly $10 million paid over four years alongside new safety commitments. Nevada and Alabama reached similar settlements, while Louisiana, Iowa, Nebraska, and Tennessee have active lawsuits, and more than 170 Roblox cases now sit consolidated in a federal multidistrict litigation in the Northern District of California following a December 2025 consolidation order.

How many gaming platform users are minors?

Roblox disclosed that among its age-checked users in 2026, 35% were under 13 and 38% were between 13 and 17, meaning 73% of age-checked daily active users were minors. The company reported 123 million total daily active users in the second quarter of 2026, up 10% year over year from 112 million in the same quarter of 2025.

Figure 2: Roblox's age-checked daily active users by age group, 2026. Source: Roblox Corporation Q2 2026 shareholder disclosures.

That demographic skew is exactly why COPPA and its state-level equivalents apply so directly to gaming platforms: a service built primarily for adults that happens to attract some younger users faces a materially different compliance bar than a platform where minors make up nearly three-quarters of the age-verified base, the same skew that makes small businesses building anything kid-adjacent a higher compliance priority than their size alone would suggest. Any studio or platform collecting player data needs terms that reflect that reality: you can generate terms of service that address account eligibility, parental consent triggers, and data handling for the age ranges your player base actually includes.

What happened in the Discord breach, and how did the ransom negotiation play out?

A threat actor group calling itself Scattered Lapsus$ Hunters infiltrated a Discord third-party customer support vendor on September 20, 2025, using stolen credentials to access support tickets and age-verification data submitted by users appealing account restrictions. Discord disclosed the breach publicly on October 3, 2025, after internal investigation and coordination with law enforcement, and said the exposed data included names, usernames, email and IP addresses, and support ticket content, but not passwords, Discord messages, or full payment card numbers. The company estimates roughly 70,000 users globally had government-issued ID photos, submitted for age verification, exposed.

Figure 3: The ransom demand attackers made against Discord, and the amount ultimately paid. Source: Bitdefender, Malwarebytes, Fox News reporting on the September-October 2025 Discord vendor breach.

Discord refused to pay at either figure, a decision consistent with law enforcement guidance and the same posture Rockstar took seven months later. The incident is a useful case study in why age-verification data specifically carries elevated risk: government ID photos are exactly the kind of high-sensitivity document that regulators expect platforms and their vendors to protect with extra controls, not the same baseline as a username or a support ticket.

Gaming-sector privacy and breach milestones, 2022-2026

Figure 4: Milestone gaming-industry privacy enforcement actions and breaches, 2022 to 2026. Sources: FTC, state attorney general offices, cybersecurity trade press.

For a studio building a COPPA compliance program from scratch, the practical decision points look like this:

Figure 5: A COPPA compliance decision path for game developers, informed by the FTC's Epic Games and Cognosphere consent orders. Source: FTC COPPA Rule guidance, FTC press releases on both settlements.

Major gaming-industry privacy penalties and breaches, 2022 to 2026

Company	Amount or records	Year	Type
Epic Games	$520 million ($275M COPPA + $245M refunds)	2022	FTC settlement
Rockstar Games	78.6 million records	2026	Third-party vendor breach
Cognosphere / HoYoverse	$20 million	2025	FTC settlement
Roblox (West Virginia)	$11 million	2026	State AG settlement
Roblox (South Dakota)	~$10 million over 4 years	2026	State AG settlement
Discord (vendor breach)	~70,000 ID photos	2025	Third-party vendor breach

The Bottom Line

Gaming sits at an unusual intersection in privacy enforcement: the player base skews younger than almost any other consumer category, which triggers COPPA's strictest requirements, while the industry's technical footprint, cloud analytics vendors, third-party customer support platforms, live-service backends, keeps expanding the attack surface a single studio has to secure. The 2022-2026 record shows both halves of that problem playing out at scale: $520 million in Epic Games penalties and a wave of Roblox state settlements on the regulatory side, and a 78.6 million-record breach at Rockstar and a 70,000-photo exposure at Discord on the security side, both reaching the target through a vendor rather than a direct attack. Any studio, platform, or app collecting player data needs terms and a privacy policy that account for a player base that may be predominantly minors, not an afterthought bolted onto adult-oriented defaults.

Frequently Asked Questions

What is the largest confirmed gaming-industry data breach? The April 2026 breach of Rockstar Games, in which the ShinyHunters group leaked 78.6 million records from a multi-domain player-analytics dataset covering GTA Online and Red Dead Online, after compromising a third-party SaaS platform called Anodot. Rockstar said no player accounts or player-facing systems were affected.

How much has the FTC fined game companies over children's data? Epic Games paid $520 million in December 2022, including a $275 million COPPA penalty, the largest penalty for breaking an FTC rule at the time. Cognosphere, maker of Genshin Impact, paid $20 million in January 2025 over COPPA violations and deceptive loot box odds.

How many Roblox users are minors? Among Roblox's age-checked users in 2026, 35% were under 13 and 38% were between 13 and 17, meaning 73% of age-checked daily active users were minors, out of 123 million total daily active users in the second quarter of 2026, per the company's own disclosures.

What data was exposed in the Discord breach? A September 2025 breach of a third-party customer support vendor exposed names, usernames, email and IP addresses, and customer support tickets, and Discord estimates roughly 70,000 users globally had government ID photos submitted for age verification exposed. Attackers demanded a $5 million ransom, later reduced to $3.5 million, which Discord refused to pay.

Where the Numbers Come From

1. Cybersecurity News. (2026). "Rockstar's GTA Game Hacked, Attackers Published 78.6 Million Records Online." Breach via Anodot SaaS platform, records published April 14-15, 2026.
2. Forbes. (2026). "Hackers Give Rockstar Games Until April 14 To Pay For Stolen Data." ShinyHunters ransom deadline and Rockstar's response.
3. Hunton Andrews Kurth. "FTC Announces $520 Million in Settlements with Epic Games." $275 million COPPA penalty, $245 million refund fund, December 2022.
4. Federal Trade Commission. (2025). "Genshin Impact Game Developer Will Be Banned From Selling Lootboxes to Teens Under 16 Without Parental Consent, Pay a $20 Million Fine." Cognosphere/HoYoverse settlement, January 2025.
5. WCHS-TV. (2026). "W.Va. attorney general announces $11M settlement with Roblox over child safety concerns."
6. South Dakota Searchlight. (2026). "$10 million settlement over online gaming child exploitation will fund safety, after-school efforts." July 2026.
7. Bitdefender. (2025). "Discord users' data stolen by hackers in third-party data breach." Vendor breach September 20, 2025, disclosed October 3, 2025.
8. Malwarebytes. (2025). "Discord warns users after data stolen in third-party breach." Roughly 70,000 government ID photos exposed, $5 million ransom demand reduced to $3.5 million and refused.
9. Music Ally. (2026). "Roblox ended Q2 2026 with 123 million daily active users." Age-checked user breakdown: 35% under 13, 38% aged 13-17, 27% aged 18 and over.

Note: All figures verified as of September 2026. The Rockstar Games breach's full scope and player impact are based on the leaked dataset's own contents as reported by multiple outlets, alongside Rockstar's statement that no player-facing systems were affected; both may be revised as investigation continues. This post will be refreshed at least twice a year to track new gaming-sector breach disclosures and regulatory settlements.