Four months after refusing to yield to ransomware demands, CD Projekt Red now watches as the stolen blueprints of its creative work — source code, employee records, the inner architecture of beloved worlds — circulate freely online. The breach, which the Warsaw studio first disclosed in February, has moved from threat to reality, confronting the company with a truth familiar to institutions that resist extortion: refusal does not guarantee safety, only a different kind of reckoning. In the broader story of digital vulnerability, this moment asks what it means to build something of cultural wei
CD Projekt confirms hacked data from Cyberpunk 2077, Witcher 3 circulating online
Hackers may have fabricated the sale to save face after failing to monetize the breach
Mark
So the hackers claimed they sold the data, but the security analyst thinks they were just making that up?
Mimi
Right. Callow's theory is that after CD Projekt refused to pay and the attackers couldn't find a real buyer through the usual channels, they announced a sale to save face. It's a way of exiting without admitting failure.
Luke
But we don't actually know if they found a buyer or not. Callow said it was "likely" they were lying, but that's an educated guess, not confirmation. The data is circulating now, so either way, the outcome is the same.
Mark
What exactly is in the leaked data? Source code, employee records—how sensitive is this?
Mimi
Source code for three major games, plus HR and accounting records. For a studio, that's extremely sensitive. The code is intellectual property worth millions. The employee data could include personal information, salary details, whatever's in a personnel file.
Luke
Though CD Projekt said they can't confirm the exact contents. They believe it relates to their games and employees, but they also warned the data may have been manipulated. So we're working with what the hackers claimed, not a full inventory.
Mark
Why does it matter that this happened right after Cyberpunk's troubled launch?
Mimi
It doesn't change what happened technically, but it adds context. The studio was already dealing with a PR crisis—a game so broken it got pulled from PlayStation. Then this breach hits. It compounds the sense that things are out of control.
Luke
That's fair as context, but the two events aren't connected. The hack happened in February; the launch problems were already public by then. The timing is unfortunate, but one didn't cause the other.
Il Polso
- Data stolen from one of gaming's most celebrated studios — including the source code of Cyberpunk 2077 and The Witcher 3 — is now circulating publicly, four months after attackers first breached CD Projekt's network.
- The studio refused to pay the ransom, but that principled stand has not prevented the stolen material from reaching the open internet, exposing employee records, contractor information, and years of proprietary development work.
- Security analysts suspect the hackers' dramatic claim of finding a buyer was a face-saving performance — theater staged to disguise the failure to profit from a breach that CD Projekt's own investigation initially suggested had not even exfiltrated data.
- CD Projekt is now coordinating with law enforcement and cybersecurity experts while threatening legal action against anyone distributing the files — a warning that carries moral weight but faces the near-impossible reality of pursuing anonymous actors across the internet.
- The breach lands on a studio already battered by the troubled launch of Cyberpunk 2077, whose instability on older consoles was severe enough to prompt Sony to pull it from the PlayStation Store entirely, compounding a season of compounding crises.
Four months after refusing to yield to ransomware demands, CD Projekt Red now watches as the stolen blueprints of its creative work — source code, employee records, the inner architecture of beloved worlds — circulate freely online. The breach, which the Warsaw studio first disclosed in February, has moved from threat to reality, confronting the company with a truth familiar to institutions that resist extortion: refusal does not guarantee safety, only a different kind of reckoning. In the broader story of digital vulnerability, this moment asks what it means to build something of cultural weight in an age when the walls around creative labor are so easily dissolved.
CD Projekt Red confirmed this week that data stolen during a February ransomware attack has begun appearing online. The leaked material likely includes source code for Cyberpunk 2077, The Witcher 3, and the card game Gwent, alongside sensitive records covering current and former employees, contractors, and internal business operations. The studio cautioned that the files may have been altered or corrupted since the original theft.
When the attack first surfaced, the hackers publicly claimed possession of the studio's most valuable repositories and demanded payment. CD Projekt refused. The attackers then announced they had sold the data to an outside buyer — a claim that security analyst Brett Callow of Emsisoft quickly characterized as likely fabricated, a way for the group to exit the situation without admitting they had failed to monetize the breach. CD Projekt's own investigation had found no evidence the data had actually left its network, a finding now complicated by the material's public appearance.
The breach arrived at an already difficult moment for the studio. Cyberpunk 2077 had launched in December 2020 to strong initial reception, but the game proved so unstable on older console hardware that Sony removed it from the PlayStation Store, where it remained unavailable months later. Together, the botched launch and the security failure drew a portrait of a studio navigating serious strain on multiple fronts.
CD Projekt says it is working with law enforcement and outside security experts to assess the full scope of the breach and notify those affected. The company has also warned of legal action against anyone distributing the stolen files — though pursuing anonymous actors online remains a formidable challenge. For now, the studio's focus is on containing damage it can no longer fully control.
CD Projekt Red, the studio behind two of gaming's most ambitious titles, confirmed this week that data stolen during a ransomware attack four months earlier has begun circulating online. The company acknowledged that the breach likely includes source code from Cyberpunk 2077 and The Witcher 3, along with sensitive information about current and former employees, contractors, and internal operations spanning human resources and accounting. The studio cautioned that the leaked material may have been altered or corrupted since the theft.
The hack itself surfaced in February when attackers locked down portions of CD Projekt's network and demanded payment in exchange for the stolen files. In a ransom note posted publicly, the hackers claimed to possess complete source code repositories for the studio's major titles—Cyberpunk 2077, The Witcher 3, and the card game Gwent—as well as comprehensive records of the company's business operations. CD Projekt refused to pay. Days later, the attackers announced they had found a buyer and would sell the data to the highest bidder outside traditional hacking forums.
That claim, however, raised immediate skepticism among security researchers. Brett Callow, a threat analyst at Emsisoft, suggested the hackers were likely fabricating the sale to preserve their reputation after failing to monetize the breach through conventional channels. The announcement of a buyer, in other words, may have been theater—a way to exit the situation without admitting defeat.
CD Projekt's own investigation had determined that while hackers successfully encrypted some employee data on the company's systems, there was no evidence the material had actually left the network. That finding contradicted the attackers' claims and raised questions about what was genuinely compromised. Now, with data appearing online, the studio faces the reality that its source code and internal records are accessible to the public, regardless of how the material escaped.
The breach arrived at a particularly vulnerable moment for the studio. Cyberpunk 2077 had launched in December 2020 to strong sales and critical praise, but players quickly encountered a game so unstable it was nearly unplayable on older console hardware. The problems were severe enough that Sony removed the title from the PlayStation Store, where it remained unavailable months later. The combination of a botched launch and a major security breach painted a picture of a studio struggling to manage both its technical and operational challenges.
CD Projekt said it is continuing to work with law enforcement and external security experts to investigate the breach and respond to its fallout. The company also warned that it intends to pursue legal action against anyone distributing the stolen data, though the practical difficulty of enforcing such threats against anonymous actors online remains substantial. For now, the studio's focus is on damage control—determining exactly what was taken, notifying affected parties, and attempting to contain the spread of proprietary information that is already beyond its control.
Citazioni salienti
The hackers were likely claiming to have found a buyer to save face after failing to monetize the hack— Brett Callow, Emsisoft threat analyst
Vuoi la storia completa?
Leggi l'originale su The Verge ↗
Business