Week of April 13, 2026: Rockstar Games Breach and Basic-Fit Data Exposure

Security leaders tracked a cluster of extortion threats and urgent patches during the week of April 13, 2026, as Rockstar Games confirmed a ShinyHunters-linked breach of its Snowflake environment and Basic-Fit disclosed a breach touching as many as 1 million gym members. The same week brought a CISA catalog update, an emergency Adobe Acrobat Reader fix for an actively exploited zero-day, critical FortiSandbox patches, an FBI phishing-kit takedown, UK government testing of Anthropic's Claude Mythos attack capabilities, and NIST's announcement that it would scale back vulnerability enrichment at the National Vulnerability Database.

Rockstar Games Confirms Cyberattack Amid ShinyHunters Extortion Threat

Rockstar Games confirmed a cyberattack after the hacking group ShinyHunters claimed to have accessed the company's Snowflake environment through a compromised third-party SaaS platform called Anodot, used for cloud cost monitoring and analytics. The attackers said they extracted authentication tokens that enabled access to a connected Snowflake account without exploiting Snowflake itself, and posted a payment deadline of April 14 on a dark web leak site. Rockstar stated that only a limited amount of non-material company information was accessed and said the incident had no impact on its organization or players. (Help Net Security)

Basic-Fit Discloses Breach Affecting Up to 1 Million Members

Basic-Fit, a European gym chain operating more than 2,150 clubs across 12 countries, disclosed that hackers breached an internal system and accessed members' personal data. The company said unauthorized access was detected by its monitoring processes and stopped within minutes, with affected members notified. An investigation by external security experts found that membership information, names, addresses, email addresses, phone numbers, dates of birth, and bank account details had been downloaded. Basic-Fit reported around 200,000 affected members in the Netherlands, while Dutch media put the total figure across six countries at approximately 1 million. (Help Net Security)

Adobe Issues Emergency Fix for Acrobat Reader Zero-Day

Adobe pushed out an emergency security update for Acrobat Reader, patching a critical prototype pollution vulnerability tracked as CVE-2026-34621 that had been exploited in the wild since November 2025. The flaw could lead to arbitrary code execution when a victim opens a malicious PDF file, though it cannot be triggered remotely. Security researcher Haifei Li flagged the in-the-wild exploitation after a malicious PDF sample was submitted to EXPMON. Adobe addressed the vulnerability across Acrobat DC, Acrobat Reader DC, and Acrobat 2024 versions for Windows and macOS, and recommended administrators install the update as soon as possible. (Help Net Security)

CISA Adds Seven Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, spanning flaws in Microsoft Visual Basic for Applications, Adobe Acrobat, Microsoft Exchange Server, Microsoft Windows, and Fortinet software. The list included CVE-2026-34621, the Adobe Acrobat and Reader prototype pollution vulnerability patched the same week, alongside older flaws such as a 2012 Microsoft VBA insecure library loading issue and a 2020 Adobe Acrobat use-after-free bug. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog entries by their due dates to protect federal networks. (CISA)

Fortinet Patches Critical FortiSandbox Vulnerabilities

Fortinet fixed two critical vulnerabilities, CVE-2026-39813 and CVE-2026-39808, in its FortiSandbox threat-detection product that could let unauthenticated attackers bypass authentication and execute unauthorized code or commands using a specially crafted HTTP request. CVE-2026-39813 is a path traversal flaw affecting FortiSandbox versions 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8, while CVE-2026-39808 affects an unspecified API in versions 4.4.0 through 4.4.8. The flaws were reported by Fortinet's own PSIRT team and a researcher from KPMG Spain, with no indication of active exploitation at the time of disclosure. (Help Net Security)

NIST Overhauls NVD Enrichment, Prioritizing Highest-Risk Vulnerabilities

NIST announced it would switch to a risk-based enrichment model for the National Vulnerability Database, prioritizing only CVEs already listed in CISA's Known Exploited Vulnerabilities catalog, those affecting software used within the federal government, or those affecting critical software defined under Executive Order 14028. The agency said CVE submissions increased 263% between 2020 and 2025, and that it enriched nearly 42,000 CVEs in 2025, 45% more than any prior year, yet still could not keep pace with the volume. CVEs that do not meet the new criteria will be labeled as not scheduled for enrichment rather than left unprocessed. (Help Net Security)

UK AI Security Institute Tests Claude Mythos's Attack Capabilities

The UK government's AI Security Institute tested Anthropic's Claude Mythos Preview model on capture-the-flag challenges and a 32-step corporate network attack simulation called The Last Ones, finding the model succeeded on expert-level CTF tasks 73% of the time. Claude Mythos Preview became the first model to solve the full simulation, succeeding in 3 of its 10 attempts, though researchers noted the test environment lacked active defenders or defensive tooling. The institute concluded the model cannot yet reliably execute autonomous attacks against well-defended systems but can navigate poorly defended ones once initial access is achieved. (Help Net Security)

FBI Dismantles W3LL Phishing Kit Operation

The FBI, working with Indonesian law enforcement, dismantled the W3LL phishing kit, a tool that impersonated login pages to steal usernames, passwords, and session data, bypassing multi-factor authentication. Officials estimated the operation was tied to more than $20 million in attempted fraud. The kit, sold for about $500, was linked to the W3LLSTORE marketplace, where more than 25,000 accounts were sold between 2019 and 2023, and later campaigns targeted more than 17,000 victims worldwide between 2023 and 2024. FBI Atlanta Special Agent in Charge Marlo Graham said, "This wasn't just phishing—it was a full-service cybercrime platform." (Help Net Security)