Video game studio CD Projekt Red, makers of The Witcher series and Cyberpunk 2077, have disclosed a ransomware attack, WIRED reports.
The attackers claimed to have stolen source code for the company’s games and threatened to release the data if the company didn’t pay the ransom. The company refused to pay, and the attackers have since claimed that they’ve sold the code.
“We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data,” CD Projekt Red stated. “We are taking necessary steps to mitigate the consequences of such a release, in particular by approaching any parties that may be affected due to the breach. We are still investigating the incident, however at this time we can confirm that – to our best knowledge – the compromised systems did not contain any personal data of our players or users of our services. We have already approached the relevant authorities, including law enforcement and the President of the Personal Data Protection Office, as well as IT forensic specialists, and we will closely cooperate with them in order to fully investigate this incident.”
CD Projekt Red added that it doesn’t know if the attackers stole data belonging to the company’s former employees, but cautions that these individuals should be on the lookout for fraud just in case.
“To our ex employees: As of this moment, we don't possess evidence that any of your personal data was accessed,” the company wrote. “However, we still recommend caution (i.e. enabling fraud alerts). If you have questions, please write to our Privacy Team dpo[at]http://cdprojektred.com.”
CD Projekt Red should be commended for resisting the pressure to pay the ransom, as this disrupts the attackers’ business model. New-school security awareness training can help your employees recognize social engineering attacks to prevent these attacks from occurring in the first place.
WIRED has the story.
