In the long history of creative labor and its protection, few threats cut as deeply as the seizure of the very blueprints from which imagination is built. CD Projekt Red, the Polish studio behind two of gaming's most celebrated franchises, disclosed on Tuesday that hackers had stolen the source code of Cyberpunk 2077 and The Witcher 3, along with sensitive internal documents, and were demanding payment for their silence. The studio, still navigating the turbulent aftermath of Cyberpunk 2077's troubled debut, chose defiance over compliance — refusing to negotiate, and accepting whatever consequ
CD Projekt Red hit by ransomware attack; Cyberpunk, Witcher 3 source code threatened
Hackers threatened to release the games' source code unless the studio came to an agreement
Mark
So CD Projekt got hit by ransomware—that's a criminal extortion scheme, right? They steal something valuable and demand money to keep it quiet?
Mimi
Exactly. In this case, the attackers claimed they had the source code for Cyberpunk 2077 and The Witcher 3, plus internal company documents. They said they'd release it all unless CD Projekt paid up.
Luke
But we should be clear: the attackers *claimed* to have the code. Did CD Projekt confirm that the breach actually happened and that those specific files were taken?
Mimi
The studio confirmed the network was hacked. They didn't dispute the attackers' claims about what was stolen, but they also said no player personal data was compromised.
Mark
Why does it matter whether player data was stolen versus just the source code?
Mimi
Player data is regulated. If customer information got out, CD Projekt would face legal consequences and regulatory investigations. Source code is valuable but it's a different kind of problem—competitive and reputational.
Luke
Right. And CD Projekt said they wouldn't pay and wouldn't negotiate. That's a strong public stance, but we don't know what happened behind closed doors or what the actual ransom demand was.
Mimi
Fair point. The public statement is defiance, but the real negotiation—if any—would be invisible.
Mark
What happens next? Does the code actually get released?
Mimi
That depends on whether the attackers follow through on their threat. CD Projekt has said no, but they've also taken a hard line publicly, which sometimes provokes attackers to prove they have what they claim.
Luke
And we should note: this happened just two months after Cyberpunk 2077 launched to a lot of criticism. The studio was already dealing with trust issues.
Mark
So this is a company in a vulnerable moment getting hit with a major security incident.
Mimi
Exactly. The timing couldn't be worse.
The Pulse
- Hackers breached CD Projekt Red's network and seized the source code of its most valuable games, along with internal accounting, legal, and HR documents — a theft striking at the studio's creative and corporate core.
- The attackers published their ransom note through the studio's own Twitter account, turning the breach into a public ultimatum and amplifying the pressure on a company already under intense scrutiny.
- The studio confirmed no player personal data was taken, narrowing the immediate legal exposure but doing little to reduce the threat of irreplaceable intellectual property appearing online.
- CD Projekt Red declared it will not pay and will not negotiate — a firm public stance that forecloses a quiet resolution and leaves the fate of its stolen code in the hands of those who took it.
- Coming just two months after Cyberpunk 2077's damaging launch, the attack lands on a studio already in the fragile work of rebuilding trust, adding a new and unpredictable variable to its recovery.
In the long history of creative labor and its protection, few threats cut as deeply as the seizure of the very blueprints from which imagination is built. CD Projekt Red, the Polish studio behind two of gaming's most celebrated franchises, disclosed on Tuesday that hackers had stolen the source code of Cyberpunk 2077 and The Witcher 3, along with sensitive internal documents, and were demanding payment for their silence. The studio, still navigating the turbulent aftermath of Cyberpunk 2077's troubled debut, chose defiance over compliance — refusing to negotiate, and accepting whatever consequences that refusal might bring.
CD Projekt Red disclosed Tuesday that hackers had broken into its network and made off with source code for two of its most prized franchises — Cyberpunk 2077 and The Witcher 3 — along with an unreleased version of the latter and the card game Gwent. The attackers also claimed to have obtained internal documents from the studio's accounting, legal, and human resources departments, broadening the breach well beyond the creative into the confidential machinery of the business itself.
The ransom demand was delivered with theatrical directness: the hackers shared their note through CD Projekt's own Twitter account, threatening to release everything they had taken unless the studio agreed to negotiate. Source code is the architectural foundation of any game — its exposure can reveal development methods, security weaknesses, and competitive secrets that studios spend years and fortunes protecting.
CD Projekt's response left little room for ambiguity. The company confirmed that no player personal data had been compromised — a meaningful distinction that spared it from immediate regulatory consequences — and announced flatly that it would neither pay the ransom nor enter into any negotiation with the attackers. It was a public refusal to be extorted, even as the threat of exposure remained very much alive.
The breach arrived at a particularly punishing moment. Cyberpunk 2077 had launched in December 2020 to widespread criticism, its performance failures overshadowing years of anticipation. The studio was already in the careful, slow work of restoring credibility with players and investors when this new crisis emerged — one with the potential to complicate not just its reputation, but the competitive future of its most important creative properties.
CD Projekt Red announced Tuesday that hackers had breached its network and stolen proprietary materials, including the source code for two of the studio's most valuable franchises. The attackers claimed access to the underlying code for Cyberpunk 2077 and The Witcher 3, along with an unreleased version of the latter title and the spinoff card game Gwent. They also said they had obtained internal documents from the Polish developer's accounting, legal, and human resources departments.
The hackers made their demands public through a ransom note shared on the studio's Twitter account. They threatened to release all the stolen materials—the source code and the internal business documents—unless CD Projekt Red agreed to their terms. The message was direct: negotiate with us, or watch your intellectual property and your private business records appear online.
For a studio that had already weathered significant public criticism over Cyberpunk 2077's troubled launch just two months earlier, the breach represented a new category of crisis. Source code is the blueprint of a game; its exposure could reveal development techniques, security vulnerabilities, and competitive advantages. The internal documents threatened exposure of financial and legal information that any company would prefer to keep private.
CD Projekt's response was unambiguous. The studio stated that it had no evidence player data or user information had been compromised in the attack—a crucial distinction, since the theft of customer personal information would have triggered regulatory obligations and broader reputational damage. More significantly, the company announced it would not pay the ransom and would not negotiate with the attackers. It was a public refusal to play along with the extortion scheme, even as the threat of code release hung over the studio's head.
The timing added another layer of difficulty. Cyberpunk 2077 had launched in December 2020 to widespread disappointment, with performance issues and bugs that overshadowed the game's ambitions. The studio was already in the process of rebuilding trust with players and investors. A ransomware attack that exposed the game's source code and internal business operations was the last complication the company needed as it worked to stabilize its reputation and plan its next moves.
Notable Quotes
CD Projekt will not give in to the hackers' demands or negotiate with them— CD Projekt Red statement
Want the full story?
Read the original at CNET ↗
Business