In the long history of creative labor meeting digital vulnerability, CD Projekt Red — the Warsaw studio behind Cyberpunk 2077 and The Witcher — found itself on Tuesday confronting a ransomware attack that threatened to expose the inner architecture of its most celebrated works. Hackers breached internal systems and demanded payment in exchange for silence, wielding the studio's own source code as leverage. The company refused to negotiate, accepting the risk that years of proprietary development might be made public, while affirming that the personal data of its players remained untouched.
CD Projekt Red hit by cyberattack; hackers threaten to release game source code
We will not give in to the demands nor negotiate
Mark
So the hackers got the actual code that makes these games run? That's different from stealing player data, right?
Mimi
Yes. They compromised internal systems and threatened to release the source code for multiple games—the blueprints, essentially. But CD Projekt confirmed player personal information wasn't in those systems, which is the part that would have exposed millions of people to identity theft or fraud.
Luke
Right, but we should be clear: the studio said player data wasn't compromised "to our best knowledge." They were still investigating. That's not the same as a complete forensic audit.
Mimi
Fair point. They were being cautious with their language. But the threat itself was real—the hackers had something valuable enough to demand payment for it.
Mark
Why would CD Projekt refuse to pay? Wouldn't that just guarantee the code gets released?
Mimi
That's the calculation they made. They said they wouldn't negotiate, even knowing the data might go public. It's a stance some companies take to avoid encouraging future attacks.
Luke
Though we don't know what the actual ransom demand was. We don't know if it was millions or something else. That context matters for understanding whether refusing was brave or just the only realistic option.
Mark
And this happened right after Cyberpunk 2077 had this disastrous launch?
Mimi
Yes. The game shipped with major bugs on PlayStation 4 and Xbox One. Sony pulled it from their store and offered refunds. So the studio was already dealing with a crisis.
Luke
The source material doesn't say whether the cyberattack was connected to the launch problems or just coincidental timing. We shouldn't assume a connection.
Mark
What happens now?
Mimi
They're working with law enforcement and forensic specialists. If the hackers release the code, it becomes a different problem—competitors could study it, security researchers could find vulnerabilities, the competitive advantage is gone. But at least player privacy wasn't the casualty.
El Pulso
- Attackers breached CD Projekt Red's internal systems and left a ransom note threatening to release source code for Cyberpunk 2077, The Witcher 3, Gwent, and unreleased game content unless demands were met.
- The studio's refusal to negotiate is a high-stakes gamble — one that openly invites the hackers to follow through on their threat and flood the internet with years of proprietary development work.
- Player personal data was confirmed safe, offering a narrow but meaningful reassurance amid an otherwise sweeping breach of internal materials.
- The attack lands at the worst possible moment: the studio was already under fire for Cyberpunk 2077's troubled launch, which had prompted Sony to pull the game from its digital storefront entirely.
- Law enforcement and forensic specialists have been engaged to investigate the breach and contain the fallout, though the timeline for resolution remains uncertain.
In the long history of creative labor meeting digital vulnerability, CD Projekt Red — the Warsaw studio behind Cyberpunk 2077 and The Witcher — found itself on Tuesday confronting a ransomware attack that threatened to expose the inner architecture of its most celebrated works. Hackers breached internal systems and demanded payment in exchange for silence, wielding the studio's own source code as leverage. The company refused to negotiate, accepting the risk that years of proprietary development might be made public, while affirming that the personal data of its players remained untouched.
CD Projekt Red, the Warsaw-based studio behind Cyberpunk 2077 and The Witcher, disclosed on Tuesday that it had suffered a targeted cyberattack. The perpetrators breached internal systems and issued a ransom note with a specific threat: pay up, or face the public release of source code for multiple games — including an unreleased version of The Witcher 3 — along with other sensitive internal materials.
The studio's answer was unambiguous. In a public statement, CD Projekt Red said it would not negotiate or pay, acknowledging openly that this stance could result in the compromised data being dumped online. The company committed to working with affected parties and limiting the damage if that occurred. Crucially, the studio confirmed that player personal data — login credentials, payment details, personal identities — had not been part of the breach, offering some reassurance to the millions who had purchased their games.
The attack arrived during an already difficult chapter for the studio. Cyberpunk 2077 had launched in December to widespread technical criticism, particularly on older consoles, and Sony had taken the unusual step of removing the game from its digital storefront and offering refunds. CD Projekt Red was already in a defensive posture when the cyberattack became public.
To investigate the breach and secure compromised systems, the studio brought in law enforcement and IT forensic specialists. The deeper concern was not immediate financial loss but the erosion of competitive advantage — the prospect that years of carefully guarded development work might soon be freely accessible to anyone online.
CD Projekt Red, the Warsaw-based studio behind two of gaming's most ambitious franchises, disclosed on Tuesday that it had fallen victim to a targeted cyberattack. The perpetrators had breached internal systems and left behind a ransom note demanding payment in exchange for silence. The threat was specific and sweeping: release the source code for Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased iteration of The Witcher 3, along with other sensitive internal materials, unless the studio capitulated to their terms.
The studio's response was equally clear. In a statement posted to Twitter, CD Projekt Red announced it would refuse to negotiate or pay. The company acknowledged the risk this stance carried—that the hackers might follow through on their threat to dump the compromised data publicly—but said it was prepared to absorb that consequence. The studio committed to working with affected parties and taking steps to limit the damage should the source code and other materials surface online.
What made the breach particularly significant was what it did not contain. CD Projekt Red confirmed that player personal data—the kind of information that typically concerns consumers most in a data breach—had not been compromised. The studio's investigation was still ongoing, but on this point, the company expressed confidence. The systems that fell to the attackers held internal development materials and corporate information, not the login credentials, payment details, or personal identities of the millions of people who had purchased their games.
The timing of the attack added another layer of complication to an already turbulent period for the studio. Cyberpunk 2077 had launched in December across PlayStation 4, Xbox One, and PC, with versions also playable on the newer PlayStation 5 and Xbox Series X consoles. The release had been marred by technical problems. The PlayStation 4 and Xbox One versions in particular shipped with significant bugs and performance issues that frustrated players. Sony Interactive Entertainment had responded by removing the game from its digital storefront and offering refunds, a rare move that underscored the severity of the problems. CD Projekt Red had pledged to fix the game through patches, but the studio was already in a defensive posture when the cyberattack became public.
The studio moved quickly to involve outside help. Law enforcement and IT forensic specialists were brought in to investigate the breach, determine its scope, and help secure the compromised systems. The investigation would take time, but the immediate priority was clear: prevent further damage and prepare for the possibility that years of proprietary game development work might soon be available to anyone with an internet connection. For a studio that had invested enormous resources into building these games, the prospect of source code becoming public represented a different kind of loss—not financial in the immediate sense, but a loss of competitive advantage and technical secrecy that could affect future development.
Citas Notables
We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data.— CD Projekt Red statement
To our best knowledge, the compromised systems did not contain any personal data of our players or users of our services.— CD Projekt Red statement
Quieres la nota completa?
Lee el original en UPI News ↗
Technology