A new wrinkle in the ever-growing story about CD Projekt Red and the fallout from Cyberpunk 2077, the company was hit by a new cyber attack. The company posted a tweet this morning letting fans know of the situation that someone hacked into their system, left a random note, and basically gave them 48 hours to do something about it. Here's the full statement from the company along with the ransom note left behind.
Yesterday we discovered that we have become a victim of a targeted cyber attack, due to which some of our internal systems have been compromised.
An unidentified actor gained unauthorized access to our internal network, collected certain data belonging to CD PROJEKT capital group, and left a ransom note the content of which we release to the public. Although some devices in our network have been encrypted, our backups remain intact. We have already secured our IT infrastructure and begun restoring the data. We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data. We are taking necessary steps to mitigate the consequences of such a release, in particular by approaching any parties that may be affected due to the breach.
We are still investigating the incident, however at this time we can confirm that —to our best knowledge — the compromised systems did not contain any personal data of our players or users of our services. We have already approached the relevant authorities, including law enforcement and the President of the Personal Data Protection Office, as well as IT forensic specialists, and we will closely cooperate with them in order to fully investigate this incident.
It's not exactly the news the company wanted to wake up to this week, especially having to battle lawsuits while trying to fix a game that was broken upon release. Aside from the fact that it sounds like part of this attack is going to involve doxxing, we really have to wonder, what more "damaging" content could there honestly be? Yes, it would hurt the company to lose assets pertaining to their games and how they make them, but if the attack is all due to Cyberpunk 2077's poor rollout, it seems like most everything is either out in the public eye already or will eventually be revealed in court. So unless there's some insane secrets that they have documentation about, it really doesn't feel like anything major is hiding in the wings. Either way, sometime between Wednesday and Thursday (depending on when they got that 48-hour notice), we'll know one way or the other.