Glassbox

Anodot Breach Exposes Dozen Companies to Extortion

A hacking group identifying itself as ShinyHunters claims to have accessed corporate data linked to Rockstar Games via a breach of business-monitoring vendor Anodot, which integrates with Snowflake cloud data warehouses. Attackers posted an extortion ultimatum on a Darknet site, giving Rockstar until 2026-04-14 to make contact and potentially pay or face data leaks. Anodot reported service disruptions days after the incident. Rockstar confirmed a limited third‑party data leak affecting non‑material company information and said the incident does not affect its players or operations. Reports from security outlets (e.g., Bleeping Computer) say dozens of other companies may also have had data stolen. The episode highlights risks from compromised B2B SaaS connectors into cloud data platforms and ongoing extortion campaigns against enterprise customers.

Apple demands labeling of session replay in apps

Apple is enforcing disclosure or removal of session replay analytics in iOS apps. The company states its App Store Review Guidelines require explicit user consent and a clear visual indication when recording or logging user activity, and has notified developers to remove the implicated code or disclose its use within a very short window, or risk removal from the App Store. The report highlights that apps from Singapore Airlines, Expedia, and Hollister allegedly used Glassbox software to record users’ screens without knowledge, prompting Apple to act. TechCrunch provides the origin of the disclosure, and The App Analysts corroborate findings. The issue also touches Android, as Glassbox is reportedly available on that platform, though Google has not publicly commented. Android Play Store policies against such tracking are noted, suggesting potential broader exposure of this practice across platforms.

iPhone Apps Use Session Replay to Record Screens

The article reports that a practice called session replay records user interactions inside iPhone apps using Glassbox’s tool. Brands such as Abercrombie & Fitch, Hotels.com, and Singapore Airlines are cited as using Glassbox to capture user sessions within apps. While masking is required to protect sensitive data, investigations by The App Analyst found failures in masking, notably in Air Canada’s app where unencrypted credit card details and passwords were visible in screenshot data. Some apps reportedly masked data adequately, but there were still instances where emails or postal codes could be exposed. Privacy policies rarely mention session replay, and Apple does not require disclosure. Users can attempt to block Glassbox domains via DNS or uninstall affected apps to mitigate exposure. The piece underscores ongoing privacy concerns around in-app data collection and the need for transparency in how session replay is implemented.