CD Projekt is a victim of ransomware and expects data to be leaked
CD Projekt has fallen victim to ransomware. The parent company of the Cyberpunk 2077 developer shows a note that the attackers left on internal systems. CD Projekt does not respond to the demands and expects stolen data to be leaked.
According to CD Projekt Red unknown attackers have gained access to internal networks of the CD Projekt Capital Group. According to the developer, they obtained ‘certain data’ there, but as far as is known, it does not concern data from players.
The intruders have left a note claiming they have stolen source code from Cyberpunk 2077, Witcher 3, Gwent, and the unreleased version of Witcher 3. By the latter, the attackers probably mean the enhanced version for next-gen consoles and PC that the developer is working on. The attackers also say they obtained various administrative and accounting documents. CD Projekt Red has not confirmed this, but does not deny it either.
In their threatening letter, the attackers write that CD Projekt has 48 hours to contact them. If the Polish company does not meet the requirements, the source code files will be ‘sold or leaked’ and the documents will be sent to game journalists. It is unknown what the attackers are demanding.
CD Projekt Red says it will not negotiate with the attackers and will not pay a ransom. The company has backups and has started restoring them to restore its network. The developer says it is taking measures to “soften the consequences of a release” of the captured documents “in particular by approaching parties that may be affected”.
The investigation into the incident is still ongoing, but CD Projekt Red says it has so far found no evidence of any player data being stolen. The company has notified relevant authorities and hired security specialists for further investigation.
Threat letter to CD Projekt Red