Cyberpunk 2077 and The Witcher 3. GTA 6 and Other Biggest Leaks in Gaming's History
Table of Contents
In February 2021, was a serious attack was directed at CD Projekt RED's servers. Some data was stolen and some computers connected to the internal network were encrypted by hackers. It was a ransomware attack – the criminals demanded a ransom for returning the information they obtained. And the casualties turned out to be really significant.
The message from hackers indicated that they obtained source codes of Cyberpunk 2077, The Witcher 3, Gwent and an unreleased version of The Witcher 3. In addition, stolen data included that related to accounting, human resources, legal and investor relations. The thieves threatened to sell the data or make it available online, and the disclosure was to threaten the company's image and cause a drop in the share price. However, CDPR did not intend to negotiate with the hackers. Their official message read:
Yesterday, we discovered that we have become a victim of a targeted cyber attack due to which some of our internal systems have been compromised
An unidentified actor gained unauthorised access to our internal network, collected certain data belonging to CD Projekt capital group and left a ransom note the content of which we released to the public. Although some devices in our network have been encrypted, our backups remain intact. We have already secured our IT infrastructure and begun restoring the data.
We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data. We take the necessary steps to mitigate the consequences of such a release, in particular by approaching any parties that may be affected due to the breach.
Aftermath
Since CD Projekt refused meet the demands of the blackmailers, the hackers immediately fulfilled some of their threats. The next day, the source code of one of their games surfaced on the web – Gwent.The thieves hackers also announced an auction of packs with the source code of Cyberpunk 2077, The Witcher 3, Blood Wars and a test version of The Witcher with RTX support. In addition, the files again contain also documentation related to investors, HR and finance departments. The starting price was set at a million dollars, and the entry fee to participate in the auction on the Russian hacking forum was 0.1 bitcoin (approx. 4.5 thousand dollars).
Soon after, information about the finalization of the purchase with a single transaction appeared, which could indicate that the pack was sold to one person. It was not revealed to whom or for how much, but the starting price of the entirety of hacked archives was about 7 million dollars. All this was reported by the KELA organization, which monitors the darknet. Worse still, there have also been reports that the personal data of CD Projekt employees were obtained in the attack. In order to avoid various threats, such as attempts to extort loans, the company officially advised them to renew their identity cards, for example.
This all happened in February 2021. In early June, there were reports that the source code files of Cyberpunk 2077 and The Witcher 3 were published. While it is password-protected, you can receive it for 10,000 dollars in cryptocurrencies. Hackers called it a "charity fundraiser." It is also worth noting that the files with the development tools for consoles were not password-protected. Therefore, downloading stolen data was not common and not available to everyone. Instead, fake password links appeared quickly, of course, with hidden malware. The thieves also emphasized that they do not share any sensitive business data, NDAs nor company reports in these files.
The hacker attack coincided with a very difficult time for CD Projekt RED. The company's image was severely tarnished by the disastrous launch of Cyberpunk 2077. In a direct message, we heard that the data leak was supposed to delay development of the major patch 1.2 for that game. It is difficult to say whether the incident had a direct impact on other processes, because Cyberpunk was pretty much the only thing people talked about in context of CD Project. The share prices hit record low. US investors filed several class action lawsuits against CD Projekt due to misinformation about game quality, which was eventually consolidated into a single case. Here, it was decided to settle and pay out nearly $2 million in compensations. Several important people also left the ranks of the studio.
So far, we have not heard about any consequences of the leak or punishment of the perpetrators. Cyberpunk 2077, after subsequent updates, got back on its feet and managed to break its popularity records, and we're also waiting for seizable DLCs. The company also announced new projects from the Witcher universe, now only codenamed Polaris, Canis Majoris & Sirius.
