In the long and complicated relationship between creative labor and digital vulnerability, CD Projekt Red — the Polish studio that built worlds beloved by millions — found itself in February 2021 facing an adversary not of its own fiction: an unseen intruder who walked out with the blueprints of its imagination. The breach, which exposed source code for some of the studio's most celebrated titles, arrived at a moment when the company was already navigating the wreckage of a troubled launch, reminding the industry that the risks of creation extend well beyond the act of making.
CD Projekt Red Hacked; Source Code for 'Cyberpunk 2077,' 'Witcher' Stolen
We will not give in to the demands nor negotiate
Mark
So CD Projekt Red got hacked—but they're saying player data is safe. What actually got stolen?
Mimi
The attackers took the full source code for several major games: Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased version of The Witcher 3. That's the underlying code that makes these games run.
Luke
And we know this how? Because the hackers said so in their ransom note?
Mimi
Yes. CD Projekt Red confirmed it in their statement. The company is being transparent about what was compromised.
Mark
Why does source code matter so much? It's not like player passwords or credit cards.
Mimi
Source code is the blueprint. It's worth millions. Competitors could study it, find vulnerabilities, or use it to reverse-engineer their own versions. It's also embarrassing—it shows how the game was built, what shortcuts were taken.
Luke
The ransom note gave them 48 hours. Did CD Projekt Red pay?
Mimi
No. They said publicly they would not negotiate, even knowing the code might be leaked anyway.
Mark
That's a bold move. What happens if the hackers release it?
Mimi
The code becomes public. Modders could exploit it. Security researchers could find flaws. It's a loss, but the company decided the principle of not rewarding extortion mattered more.
Luke
One thing worth noting: we don't know who did this. The statement says "unidentified actor." Could be a lone hacker, could be a criminal group, could be state-sponsored. That's still open.
Mark
And this comes right after Cyberpunk 2077 had that disaster launch?
Mimi
Exactly. The game was broken when it shipped, Sony pulled it from their store, refunds were issued. Now, weeks later, the source code is stolen. It's been a rough stretch for the studio.
El Pulso
- An unidentified attacker breached CD Projekt Red's internal systems and seized complete source code for Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased Witcher 3 build — intellectual property representing years of development work.
- The hackers escalated pressure by publishing their ransom note openly, giving the studio just 48 hours to pay before threatening to leak or sell the stolen code and flood gaming journalists with internal documents.
- CD Projekt Red drew a firm line: no negotiation, no payment — even while acknowledging the refusal could result in the stolen material being released into the wild.
- The studio moved to contain the damage by contacting law enforcement and Poland's data protection authority, while reassuring players that no personal data had been compromised.
- The attack landed on a company already reeling from Cyberpunk 2077's disastrous December 2020 launch — a release so broken that Sony pulled it from the PlayStation Store entirely — deepening an already painful chapter in the studio's history.
In the long and complicated relationship between creative labor and digital vulnerability, CD Projekt Red — the Polish studio that built worlds beloved by millions — found itself in February 2021 facing an adversary not of its own fiction: an unseen intruder who walked out with the blueprints of its imagination. The breach, which exposed source code for some of the studio's most celebrated titles, arrived at a moment when the company was already navigating the wreckage of a troubled launch, reminding the industry that the risks of creation extend well beyond the act of making.
On a Tuesday in February 2021, CD Projekt Red — the Polish studio behind "Cyberpunk 2077" and "The Witcher" series — disclosed that an unidentified attacker had broken into its internal systems and taken something irreplaceable: the source code for its most significant titles. The stolen material included complete copies of the code for "Cyberpunk 2077," "The Witcher 3," the card game "Gwent," and an unreleased version of "The Witcher 3."
The studio was careful to draw a distinction that mattered to its players: no personal data or user information had been taken. What the attackers wanted was leverage over the company itself. They made their demands public — a calculated act of humiliation — and gave CD Projekt Red 48 hours to pay, threatening to leak the code online, sell it to the highest bidder, or hand internal documents to gaming journalists if the studio refused.
CD Projekt Red refused. In a statement, the company acknowledged that its decision not to negotiate might result in the stolen material being released, but said it would not yield to extortion. Law enforcement and Poland's data protection authority were notified as the studio began the formal work of response and investigation.
The breach arrived at the worst possible moment. Just months earlier, "Cyberpunk 2077" had launched in December 2020 as one of the most anticipated games in years — and collapsed under the weight of its own ambition, arriving riddled with glitches so severe that Sony removed it from the PlayStation Store and offered refunds. The hack compounded what was already a deeply difficult period, adding the threat of exposure to an organization still trying to rebuild its reputation.
CD Projekt Red, the Polish video game studio behind "Cyberpunk 2077" and "The Witcher" franchise, disclosed on Tuesday that it had fallen victim to a cyberattack. An unidentified threat actor had breached the company's internal systems and made off with proprietary material the studio could not afford to lose.
In a statement posted to social media, the company confirmed that its networks had been compromised but moved quickly to clarify what had not been taken. Player data and user information remained secure, the studio said—a crucial distinction in an era when breaches often mean stolen personal details sold on dark web marketplaces. The attackers, however, had obtained something else entirely: complete copies of the source code for "Cyberpunk 2077," "The Witcher 3," the card game "Gwent," and an unreleased version of "The Witcher 3."
The hackers released their ransom note publicly, a tactic designed to apply pressure not just through threat but through humiliation. They demanded payment and gave the studio 48 hours to comply. If CD Projekt Red refused, they promised to leak the stolen code online or sell it to interested parties. They also threatened to send the company's internal documents to gaming journalists, a secondary pressure point aimed at amplifying the damage through public exposure.
CD Projekt Red's response was unambiguous: the studio would not pay. In its statement, the company said it was aware that refusing to negotiate "may eventually lead to the release of the compromised data," but it would not capitulate to extortion. The studio had already contacted law enforcement and Poland's Personal Data Protection Office, beginning the formal process of investigation and response.
The timing of the breach added another layer of difficulty for a company already struggling with its public image. Months earlier, "Cyberpunk 2077" had launched to widespread technical failure. The game, which had been delayed multiple times and featured Keanu Reeves in a prominent role, arrived in December 2020 riddled with glitches and performance problems so severe that Sony removed it from the PlayStation Store and began offering refunds to dissatisfied customers. The studio was still managing the fallout from that disaster when the hack occurred, compounding what had already been a difficult period for the organization.
Citas Notables
We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data.— CD Projekt Red statement
Quieres la nota completa?
Lee el original en Variety ↗
Business