In the early days of February 2021, CD Projekt — the Polish studio that gave the world The Witcher and Cyberpunk 2077 — found itself not only navigating the aftermath of a troubled game launch but facing a ransomware assault by a professional extortion group known as HelloKitty. The attackers encrypted company data, claimed to hold source code and sensitive documents hostage, and issued a 48-hour ultimatum. CD Projekt's refusal to negotiate, and its choice to speak openly about what had happened, placed the company at the center of a broader question the digital age keeps asking: when criminal
CD Projekt hit by HelloKitty ransomware; refuses to pay, vows transparency
We will not negotiate with the actor, aware this may lead to release of data
Mark
So CD Projekt got hit by ransomware. How bad is this really?
Mimi
The attackers claim they have the source code for multiple games—Cyberpunk 2077, Witcher 3, Gwent, and an unreleased Witcher version. They also took financial and HR documents. But the company said no user data was stolen, which matters.
Luke
Right, but we should be careful about the word "claim." We don't know yet if they actually have what they say they have. The ransom note says they do, but that's the attacker's version.
Mimi
Fair point. What we do know is that CD Projekt refused to pay or negotiate, which is the interesting part.
Mark
Why would they do that? Doesn't that guarantee the code gets leaked?
Mimi
That's the gamble. But security experts say paying doesn't guarantee silence anyway. And paying funds the next attack.
Luke
Also, HelloKitty has a track record. They hit a Brazilian energy company last year. This isn't personal—it's a professional operation.
Mark
So the "angry gamer" theory is wrong?
Mimi
Completely. The attackers gave a 48-hour deadline and threatened to sell the code or send documents to journalists. That's standard ransomware playbook.
Luke
Though we should note: we don't actually know if they'll follow through. The threat is real, but the execution is still unknown.
Mark
What does Kaspersky say?
Mimi
They support the refusal to pay. They also praised CD Projekt for being transparent about it—publishing the ransom note and all.
Luke
Which is interesting because transparency is rare in these situations. Most companies pay quietly and hope it goes away.
Mark
So CD Projekt is taking the principled route?
Mimi
Or the risky one. We'll find out if the code actually gets released.
O Pulso
- HelloKitty ransomware operators breached CD Projekt's systems, encrypted critical data, and threatened to publicly release source code for Cyberpunk 2077, Witcher 3, and Gwent within 48 hours if no ransom was paid.
- The attack landed at the worst possible moment — CD Projekt was already absorbing a stock price collapse of roughly a third following Cyberpunk 2077's bug-ridden console launch just months earlier.
- Security researchers at Emsisoft quickly identified HelloKitty as a professional criminal operation, not disgruntled gamers, pointing to prior attacks on Brazilian energy giant CEMIG and victims dating back to November 2020.
- CD Projekt refused to pay or negotiate, published the ransom note itself, and coordinated with affected third parties — a posture of transparency that drew explicit endorsement from Kaspersky.
- The unresolved threat hangs over the gaming industry: whether HelloKitty will release the stolen code and documents, and what that exposure could mean for CD Projekt and studios watching closely.
In the early days of February 2021, CD Projekt — the Polish studio that gave the world The Witcher and Cyberpunk 2077 — found itself not only navigating the aftermath of a troubled game launch but facing a ransomware assault by a professional extortion group known as HelloKitty. The attackers encrypted company data, claimed to hold source code and sensitive documents hostage, and issued a 48-hour ultimatum. CD Projekt's refusal to negotiate, and its choice to speak openly about what had happened, placed the company at the center of a broader question the digital age keeps asking: when criminals hold knowledge itself for ransom, what does integrity look like under pressure?
On February 9, 2021, CD Projekt disclosed that it had been struck by a ransomware attack carried out by a group identified by Emsisoft as HelloKitty. The attackers had penetrated the company's systems, exfiltrated significant volumes of data, encrypted it, and left behind a ransom demand with a 48-hour deadline. CD Projekt moved quickly to reassure its community that no personal user data had been compromised.
The attackers claimed to possess the full source code for Cyberpunk 2077, Witcher 3, Gwent, and an unreleased version of Witcher 3, along with accounting records, legal documents, HR files, and investor correspondence. Their threat was clear: pay up or watch the code go public and the documents land in the inboxes of gaming journalists.
CD Projekt's answer was equally clear. The company would not pay, would not negotiate, and accepted that this stance might result in the data being released. Rather than retreat into silence, it published the ransom note — a gesture of transparency that the security community, including Kaspersky, openly praised. Kaspersky reinforced what many experts argue: paying ransoms funds the development of more sophisticated attacks and guarantees nothing, since stolen data can be leaked regardless.
Fabian Wosar of Emsisoft was direct in dismissing theories that the attack was revenge from gamers angered by Cyberpunk 2077's troubled launch. HelloKitty was a professional extortion operation whose earliest known victims predated the game's release entirely. The group had previously targeted CEMIG, a major Brazilian energy company, in late 2020 — this was organized crime, not fan frustration.
The attack arrived as CD Projekt was already absorbing serious damage. Cyberpunk 2077's November 2020 release on PlayStation 4 and Xbox One had been marred by severe bugs, triggering widespread backlash and a stock decline of roughly a third within the first week. The ransomware assault compounded an already difficult chapter. Whether HelloKitty would follow through on its threats — and what the consequences might be for the studio and the wider gaming industry — remained an open and unsettling question.
CD Projekt, the Polish developer behind The Witcher series and Cyberpunk 2077, disclosed on February 9 that it had been struck by a ransomware attack. The attackers, identified by security firm Emsisoft as the HelloKitty group, had penetrated the company's systems, downloaded substantial amounts of data, encrypted it, and left behind a ransom demand. The company moved quickly to clarify that personal information belonging to its users had not been compromised in the breach.
The attackers claimed to have obtained the complete source code for Cyberpunk 2077, Witcher 3, Gwent, and an unreleased version of Witcher 3. They also said they had exfiltrated accounting records, administrative files, legal documents, HR materials, and investor relations correspondence. The ransom note gave CD Projekt a 48-hour window to negotiate. If the company refused, the attackers threatened to sell the source code or leak it publicly, and to send the stolen documents to gaming journalists.
CD Projekt's response was unambiguous: the company stated it would neither pay the ransom nor enter into negotiations with the attackers, even understanding that this decision might result in the release of the compromised data. The company's focus instead turned to mitigation efforts and coordination with potentially affected third parties. It also published the ransom note itself, a move toward transparency that drew support from the security community.
Fabian Wosar, chief technology officer at Emsisoft, pushed back against speculation that the attack was motivated by disgruntled gamers upset over Cyberpunk 2077's troubled launch. HelloKitty, he explained, was a straightforward ransomware operation with a history of targeting major organizations. The group had previously attacked CEMIG, a Brazilian energy company, in late 2020. The earliest known victims dated to November 2020, well before Cyberpunk 2077 even shipped. This was not a revenge plot; it was business as usual for a professional extortion outfit.
The timing of the attack came as CD Projekt was already reeling from the commercial and reputational fallout of Cyberpunk 2077's launch on PlayStation 4 and Xbox One in November 2020. The game shipped with significant bugs that prompted widespread criticism. The company's stock price fell by roughly a third in the first six days after release. The ransomware attack arrived into an already turbulent moment.
Kaspersky, the global security firm, endorsed CD Projekt's decision to refuse payment and to communicate openly about the incident. The company noted that paying ransoms only made the extortion business more profitable and incentivized the development of more sophisticated malware tools. Paying also offered no guarantee that stolen data would remain private—attackers could leak it anyway. By refusing to negotiate and by being transparent about what had happened, CD Projekt set a different example, one that security experts said was worth following. The question now was whether the HelloKitty group would make good on its threat to release the source code and documents, and what consequences that might carry for the company and the broader gaming industry.
Citações Notáveis
The amount of people thinking this was done by a disgruntled gamer is laughable. This was done by a ransomware group we track as HelloKitty.— Fabian Wosar, Emsisoft chief technology officer
We support the decision not to pay, as well as such transparency in communications about the incident. Any payment to extortionists makes their ransomware business more profitable.— Kaspersky
Quer a matéria completa?
Leia o original em iTWire ↗
Business