In the early days of February 2021, CD Projekt Red — the Warsaw studio behind some of gaming's most celebrated worlds — found itself confronted not by critics or regulators, but by unseen adversaries holding its creative foundations hostage. Hackers claimed possession of source code for Cyberpunk 2077, The Witcher 3, and other titles, alongside sensitive internal documents, demanding contact within 48 hours or threatening public exposure. The studio, already navigating the turbulent aftermath of Cyberpunk 2077's troubled launch, chose defiance over compliance — a stance that speaks to somethin
CD Projekt Red Confirms Hack; Cyberpunk 2077, Witcher 3 Source Code Held Ransom
We will not negotiate with the actor
Mark
So they actually confirmed it themselves? They didn't wait for the hackers to leak it?
Mimi
Yes. CD Projekt Red posted about it on Twitter on February 9. They were direct about what was taken—source code for multiple games, internal documents across every sensitive department. They wanted to control the narrative rather than let the hackers do it.
Luke
But we should note: we're only hearing the hackers' claims about what they have. We don't have independent verification that they actually possess all of it. The 48-hour deadline and the threat are real, but the scope of what was stolen is still the hackers' assertion.
Mark
Did the company consider paying?
Mimi
No. They explicitly said they would not negotiate. That's a significant stance—refusing to engage at all, even when the threat involves source code for their biggest franchises.
Luke
Which raises a question: how confident are they that the damage is containable? Or are they betting that paying would just invite more attacks? We don't know their internal calculus.
Mark
What about player data? That seems like the thing people would care about most.
Mimi
CD Projekt Red said player data wasn't accessed. That's important because millions of people had accounts, had purchased the game, had personal information tied to those accounts.
Luke
But again—that's CDPR's assessment of what was taken. We don't have the hackers confirming or denying it. It's a claim that matters, but it's still a claim.
Mark
And this is happening right after Cyberpunk 2077 already fell apart.
Mimi
Exactly. The game launched in terrible shape. Sony pulled it from the PlayStation Store. Full refunds. But it still sold 13 million copies and made over $600 million. So the studio was in a weird position—commercially successful, reputationally damaged, and now facing a security crisis on top of it.
Il Polso
- Hackers breached CD Projekt Red's systems and claimed to hold source code for multiple flagship titles plus a cache of internal documents covering finance, legal, HR, and investor relations.
- The ransom note carried an explicit threat: pay up within 48 hours or watch the stolen material flood gaming press and tank the company's stock price — a calculated strike at an already wounded studio.
- CD Projekt Red drew a firm line, publicly refusing to negotiate or yield to the attackers' demands while working to contain whatever damage a potential leak might cause.
- The company offered a measure of reassurance to its player base, stating that no personal data belonging to customers appeared to have been compromised in the breach.
- The attack lands on top of Cyberpunk 2077's disastrous console launch — Sony refunds, store removal, viral mockery — even as the game quietly amassed $609 million in revenue and 13 million copies sold.
In the early days of February 2021, CD Projekt Red — the Warsaw studio behind some of gaming's most celebrated worlds — found itself confronted not by critics or regulators, but by unseen adversaries holding its creative foundations hostage. Hackers claimed possession of source code for Cyberpunk 2077, The Witcher 3, and other titles, alongside sensitive internal documents, demanding contact within 48 hours or threatening public exposure. The studio, already navigating the turbulent aftermath of Cyberpunk 2077's troubled launch, chose defiance over compliance — a stance that speaks to something older than any ransom note: the refusal to let fear dictate the terms of one's story.
On February 9, 2021, CD Projekt Red disclosed that it had suffered a targeted cyberattack. The hackers claimed to have extracted source code for Cyberpunk 2077, The Witcher 3, GWENT, and an unreleased build of Witcher 3, along with internal documents touching nearly every corner of the company — accounting, legal, human resources, and investor relations. Their ultimatum was blunt: make contact within 48 hours, or the stolen material would be sold and handed to gaming journalists.
The ransom note was engineered for maximum psychological pressure, predicting that public release would devastate the studio's reputation, shake investor confidence, and drag down its stock. The language was crude by design — a lever meant to exploit a company already under strain.
CD Projekt Red refused to bend. In a public statement, the studio declared it would not negotiate with the attackers and would instead focus on limiting the consequences of any potential leak. It also offered an important reassurance: as far as the company could determine, no player personal data had been exposed — a meaningful distinction for the millions who had trusted the studio with their information.
The breach arrived at a particularly bruising moment. Cyberpunk 2077 had launched in December 2020 to widespread condemnation over crippling performance issues on older consoles and a world overrun with bugs that became internet shorthand for overpromised, underdelivered games. Sony pulled the title from its PlayStation Store and offered full refunds. Yet the commercial reality told a different story: 13 million copies sold and over $609 million in revenue by year's end. The hack, then, represented a new and distinct threat — not to the studio's wallet, but to the intellectual property and institutional knowledge at the heart of everything it builds.
CD Projekt Red announced on Tuesday, February 9, that it had been the target of a cyberattack. The hackers claimed to possess the source code for multiple games in the studio's portfolio—Cyberpunk 2077, Witcher 3, GWENT, and an unreleased version of Witcher 3—along with a trove of internal documents spanning accounting, administration, legal, human resources, and investor relations. The attackers issued an ultimatum: contact them within 48 hours, or they would sell the source code and distribute the documents to gaming journalists.
The threat carried a specific warning about reputational damage. In a message included in the ransom demand, the hackers predicted that public disclosure would tank the company's image, erode investor confidence, and drive down the stock price. The language was crude and direct, designed to apply maximum psychological pressure to a studio already reeling from other crises.
CD Projekt Red's response was unambiguous. In an official statement, the company said it would neither capitulate to the demands nor engage in negotiation with the attacker. The studio committed to taking steps to limit the fallout from any potential release of the stolen materials. Crucially, the company stated that to its knowledge, no personal data belonging to players had been compromised in the breach—a distinction that mattered for the millions of people who had purchased and played the company's games.
The timing of the hack compounded an already difficult period for the Warsaw-based developer. Cyberpunk 2077 had launched in December 2020 to a storm of criticism. The game suffered from severe performance problems on older console hardware, and its open world was riddled with bugs that spawned countless viral videos and memes mocking the state of the release. The backlash was severe enough that Sony removed the game from its PlayStation Store and began issuing full refunds to customers who requested them.
Yet despite the reputational damage, Cyberpunk 2077 had proven a commercial juggernaut. By December 20, the game had sold 13 million copies worldwide. By the end of the year, it had generated over $609 million in revenue. The numbers suggested that for all the criticism, the game's brand recognition and the studio's reputation had been sufficient to drive massive sales. Now, with the hack and ransom demand, CD Projekt Red faced a different kind of threat—not to its revenue, but to the intellectual property and internal workings that underpinned its business.
Citazioni salienti
Your public image will go down the shitter even more and people will see how you shitty company functions. Investors will lose trust in your company and the stock will dive even lower.— Ransom demand message from hackers
We will not give in to the demands nor negotiate with the actor and are taking steps to mitigate the consequences of such a release.— CD Projekt Red official statement
Vuoi la storia completa?
Leggi l'originale su InvenGlobal ↗
Economy & Finance