Games maker CD Projekt hacked in ‘targeted cyber attack’

Polish gaming company CD Projekt, maker of the infamous Cyberpunk 2077, said on Tuesday it had fallen victim to a “targeted cyber attack” from an “unidentified actor” that was threatening to leak its source codes and internal documents.

CD Projekt said that during the attack, which it discovered on Monday, someone had “gained unauthorised access to our internal network, collected certain data belonging to CD Projekt capital group” and was now demanding a ransom. Its shares tumbled 6 per cent on the news.

Alongside its own statement, the gaming company also published what it said was the ransom note, which demanded that it get in touch to negotiate within 48 hours.

“Hello CD Projekt!!!!!!!!!!!!!!!!!! Your [sic] have been EPICALLY pwned!!” the message read, claiming that those behind it had gained access to source codes for CD Projekt’s flagship games Cyberpunk 2077 and Witcher 3 as well as “accounting, administration, legal, HR [and] investor relations” documents.

“If we will not come to an agreement, then your source codes will be sold or leaked online and your documents will be sent to our contacts in gaming journalism,” the note said.

CD Projekt insisted that it would “not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data”.

The company said “some devices in our network have been encrypted” during the attack, but that its back-up files remained intact, and that it had “already secured our IT infrastructure and begun restoring the data”.

It added that it was taking steps to mitigate the consequences of the attack, but that to its “best knowledge” the compromised systems “did not contain any personal data of our players or users of our services”.

The cyber attack is the latest mishap to befall CD Projekt, a Warsaw-based group founded in 1994 by Marcin Iwinski and Michal Kicinski, which achieved international success with its series of Witcher games, set in a mythical medieval world filled with magic and monsters.

Last year, the group briefly became Poland’s most valuable listed company as gamers looked forward to the release of Cyberpunk 2077, a dystopian video game featuring Hollywood star Keanu Reeves, which was one of the most expensive and highly anticipated launches in industry history.

However, CD Projekt’s fortunes nosedived after Cyberpunk’s launch was marred by glitches, prompting Sony to take the drastic step of removing the game from its online PlayStation store a week before Christmas and offering full refunds to disappointed customers.

The episode triggered a slump in CD Projekt’s shares, with the company’s market value tumbling from more than 40bn zloty in the run-up to Cyberpunk’s launch to less than 30bn zloty soon afterwards.

Kicinski said in an interview on Monday with Polish newspaper Puls Biznesu that he hoped Cyberpunk would be readmitted to Sony’s gaming store as soon as possible.