CD Projekt Data Breach Leads to Confidential Information Disclosure
A security breach that took place in February affected CD Projekt Group, a Polish video game developer. The cause is known. It was a ransomware attack, cybercriminals getting access to data stated as confidential. CD Projekt data breach caused private information of the game company to be all over the internet.
What Kind of Data Was Stolen?
The company’s website has reported in an update from yesterday, that they gained new knowledge regarding the stolen data. It seems that the information consists of: contractor and current/former employee records and also data related to video games.
Another publication, BleepingComputer, explains that, besides collecting game codes, cybercriminals might have access to administrative, accounting, HR, legal, and investor relations papers.
The leaked data, WARSAW (Reuters) – Internal company data, is circulating now anywhere on the internet. Anyhow, it is not confirmed if the revealed information is accurate or has been manipulated by the cybercriminals.
Who Is Behind This CD Projekt Data Breach?
A ransomware operation, known by its nickname “HelloKitty” was behind the CD Projekt data breach, which stole the entire their much-promoted Cyberpunk 2077 source code, Gwent, the Witcher 3, and also an unreleased version of Witcher 3.
Even though they declared the stolen information was sold, another group of cybercriminals, PayLoad Bin, claims that they published CD Projekt games’ full source code of 364GB data. The threat actor group was formerly known as Babuk Locker.
What Measures Have Been Taken?
CD Projekt announced on their website that:
Currently, we are working together with an extensive network of appropriate services, experts, and law enforcement agencies, including the General Police Headquarters of Poland. We have also contacted Interpol and Europol. The information we shared in February with the President of the Personal Data Protection Office (PUODO) has also been updated.
Therefore, because of the CD Projekt data breach, the Polish video game developer has:
- increased the size of the internal security department
- enhanced the event-monitoring systems
- settled a better protection system for networks, endpoints, and servers
- limited the access rights
- carried out new next-generation firewalls with progressive anti-malware security
Another video game maker company, Electronic Arts (EA) reported that they are also in the middle of investigating a cyberattack. Supposedly, game source codes and corresponding tools were stolen.
However, CD Projekt assured everyone in a statement on Twitter that they are putting every effort into protecting their employee’s data and are ready to take any measures if necessary:
We would also like to state that — regardless of the authenticity of the data being circulated — we will do everything in our power to protect the privacy of our employees, as well as all other involved parties. We are committed and prepared to take action against parties sharing the data in question.