Hackers leak Sony’s video game plans

• Sony’s Insomniac Games’ internal data has made its way to the dark web
• Hackers released video game data after failing to get a response from Sony. 
• The Insomniac hack is just one of the few cybersecurity incidents to have affected Sony in the past decade.

Video game leaks tend to have a bigger impact on society compared to data breaches involving personal data, simply because most of the games that end up being leaked are popular titles, which are favorites among gamers around the world.

Recently, the trailer of the popular video game Grand Theft Auto (GTA) 6 was leaked onto X. The leak resulted in shares of the video game publisher, Take-Two Interactive Software, dropping 2%. Eventually, Rockstar Games, a subsidiary of Take-Two published the GTA 6 trailer on YouTube. X also suspended the account that posted the leak. But the damage had already been done.

However, the leak of the GTA trailer is not nearly as bad as what is happening to Sony right now. Sony’s Insomniac Games’ internal data has made its way to the dark web following the passing of a ransom deadline. The Rhysida ransomware gang has leaked 1.67 terabytes of data, which contains more than 1.3 million files, onto the dark web.

The gang said in its leak post that “No sold data was uploaded, data hunters, enjoy,” and it appears some data was, in fact, sold to an enterprising bidder. Only 98% of the full dataset has been uploaded.

The ransomware gang had initially threatened to publish the data on December 12th, after publishing limited proof-of-hack material, including passport scans. While the ransom figure remains uncertain, the cybercriminals were selling the data for around US$2 million. Any buyer, including Sony, was welcome to bid.

What video games were affected by the leak?

Bloomberg reported that the data leaks included game road maps, budgets, and detailed information about Insomniac’s upcoming Wolverine game. The game was slated to be released in 2026. The files also include yet-to-be-released Marvel-inspired titles in the next decade. This includes Spider-Man 3 which is based on Venom and X-Men games as well as a reference to a new Ratchet & Clank game slated for a 2029 release.

While Sony has yet to respond to the leak, other details that were compromized included information on dozens of current and former employees. The information included compensation, personal information and photos on executive cards. Contracts showing multimillion parachute payments to executives upon the studio’s sale to Sony were also leaked along with historical financial agreements with games publishers including Oculus and EA Games.

Cyber Daily, which first reported the leak, said that Sony and Insomniac were specifically targeted by the cybercriminals. A spokesperson for Rhysida said they knew who they were attacking in an email.

“We knew that developers making games like this would be an easy target.”

It also turns out that the hack itself did not present much of a problem, with the spokesperson saying, “We were able to get the domain administrator within 20–25 minutes of hacking the network.”

Not Sony’s first time at the ransomware circus

The Insomniac hack is just one of the few cybersecurity incidents that have affected Sony in the past decade. While the current incident may not be as big as the 2014 Sony Pictures hack, the scenario does paint a similar picture.

Back in 2014, Sony Pictures suffered one of the worst hacks in the film industry. North Korean hackers claimed responsibility for the hack after Sony released a film that was mocking their leader. The threats not only succeeded at disrupting the premier of the film but also affected other films being planned by Sony.

The hackers released scripts of unreleased films as well as personal data and private emails from top executives of Sony. But that wasn’t by any means the last time Sony would suffer a cybersecurity incident.

Earlier this year, according to a report by Bleeping Computer, Sony notified current and former employees and their family members about a cybersecurity breach that exposed personal information. About 6,800 individuals have been compromised after an unauthorized party exploited a zero-day vulnerability in the MOVEit file transfer platform.

The Cl0p ransomware leverages the zero-day vulnerability for large-scale attacks that have compromised organizations worldwide. The Cl0p ransomware gang added Sony Group to its list of victims in late June, but the firm hasn’t given a public statement on the incident until now.

That’s not all. Reports show that Sony experienced another cybersecurity incident. Allegations on hacking forums show that 3.14GB of data was stolen from Sony’s systems. While Sony has responded to the claims, stating an ongoing investigation, Bleeping Computer noted that the leaked data set contains details for the SonarQube platform, certificates, Creators Cloud, incident response policies, a device emulator for generating licenses, and more.

Video game industry continues to be a target

The video game industry itself has witnessed increasing cybersecurity incidents. Capcom, another game developer, fell victim to a massive data leak three years ago. It was only recently that law enforcement agencies were able to apprehend the ransomware group responsible.

Another incident involved major game publisher Electronic Arts. The hackers claimed to have downloaded the source code for several popular games. After failing to extort the company, the hackers released the entire cache of stolen data to the dark web.

Earlier this year, Riot Games revealed that hackers had compromised its development environment with a social engineering attack. The company reassured users that no player data or personal information was compromised, but the hackers did manage to get access to the source code of several popular titles by Riot Games.

Activision also experienced a cybersecurity incident earlier this year when hackers stole internal data. Screenshots of the data, which included planned content of popular games, were published online.

---

---

---