CD Projekt Red
The hackers have threatened sell stolen game source code and distribute private documents
The studio behind the Cyberpunk 2077 video game, CD Projekt, has fallen victim to a ransomware attack in which hackers claim to have stolen video game source code and company documents.
In an attempt to blackmail the Polish video game developer, the hackers say they have stolen code relating to Cyberpunk 2077, Gwent, and what they claim to be an unreleased version of the Witcher 3 game. The hackers have threatened to sell or leak the source code unless they can "come to an agreement" with CD Projekt, and ask the studio to contact them within 48 hours.
If made public, the source code of CD Projekt's games could potentially lead to the creation of hacks, or to the unlicensed publishing of altered or even malicious versions of its games.
A ransom note left by the hackers and published this morning (February 9) by CD Projekt's Twitter account also claims they have obtained "all of your documents relating to accounting, administration, legal, HR, investor relations and more". The hackers say these documents "will be sent to our contacts in gaming journalism," and that the game developer's servers have been encrypted.
In a statement released alongside a copy of the ransom note, CD Projekt said it discovered the cyber attack on February 8 and admitted that some of its "internal systems" had been compromised.
The statement said: "An unidentified actor gained unauthorized access to our internal network, collected data belonging to CD Projekt capital group, and left a ransom note...Although some devices in our network have been encrypted, our backups remain intact. We have already secured our IT infrastructure and begun restoring the data."
CD Projekt says it will not give in to the demands of the hackers, nor will it negotiate with hackers, despite being aware this "may eventually lead to the release of the compromised data." The company says it is still investigating the hack but says that, to the best of its knowledge, the compromised systems "did not contain any personal data of our players or users of our services."
CD Projekt says it has approached law enforcement and IT forensic specialists, and says it will cooperate fully to assist with the investigation.
The cyber attack comes after the December launch of Cyberpunk 2077 angered gamers due to it not running properly when played on older Xbox One and PlayStation 4 consoles. CD Projekt has been working ever since to make the game stable on these consoles, but soon after launch Sony pulled the game from sale on its online PlayStation store and began offering refunds. In mid-December, CD Projekt released a statement explaining how unhappy gamers can receive a refund for the buggy game.