Loading story…
Hackers gained unauthorized access to Ubisoft's Rainbow Six Siege servers, resulting in widespread manipulation of the game's in-game economy and administrative systems. Players around the world reported receiving billions of R6 Credits, Renown, and exclusive cosmetic items, including developer-only skins, directly into their accounts. The attackers also abused internal moderation tools to ban and unban accounts, including those belonging to Ubisoft administrators and popular streamers, and used the in-game ban feed to broadcast taunting and cryptic messages to the player base.
Ubisoft responded by confirming the breach, intentionally shutting down Rainbow Six Siege and its in-game Marketplace to contain the incident, and announcing that all transactions since the attack would be rolled back. The company clarified that players would not be penalized for spending the illicitly granted credits and that the fake ban messages were not generated by Ubisoft. As of the latest updates, Ubisoft was still working to restore full service and had not disclosed the technical details of how the breach was accomplished.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By December 29, 2025, Ubisoft had restored Rainbow Six Siege services after the shutdown. The company continued reversing unauthorized changes from the breach, while keeping the in-game marketplace closed for additional review.
On December 28, 2025, reporting surfaced that a separate recent Ubisoft source-code theft was attributed to a different threat actor and allegedly involved exploitation of the MongoBleed vulnerability, CVE-2025-14847. These claims were presented as distinct from the confirmed Rainbow Six Siege in-game abuse, and Ubisoft had not confirmed the broader allegations.
On December 28, 2025, Ubisoft publicly acknowledged the breach-related disruption, intermittently kept services offline, and indicated it would roll back player data and transactions to undo unauthorized credits, items, and account changes. Ubisoft also clarified that players would not be punished for spending illicitly granted credits.
On December 27, 2025, Ubisoft shut down Rainbow Six Siege servers in response to the breach and resulting loss of control over game systems. The outage also affected normal gameplay as the company worked to contain the incident.
By December 27, 2025, attackers had gained extensive control over Rainbow Six Siege backend or administrative systems. Reports describe mass bans and unbans, fake ban-feed messages, and unauthorized grants of huge amounts of credits, Renown, and rare or developer-only cosmetic items to players.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetomshardware.com
Open sourcetomshardware.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in MongoDB, identified as CVE-2025-14847 and dubbed 'MongoBleed,' has been publicly disclosed, with a proof-of-concept (PoC) exploit released. The flaw resides in MongoDB's use of the `zlib` compression library, allowing unauthenticated attackers to send specially crafted messages that cause the server to leak fragments of its internal memory. This memory leak can expose sensitive data such as clear-text passwords, login keys, personal information, and security tokens, all without requiring authentication. The impact of this vulnerability became immediately apparent when Ubisoft was forced to shut down its popular game, Rainbow Six Siege, after attackers exploited MongoBleed to compromise player accounts and internal systems. Thousands of gamers were locked out as a result, highlighting the real-world risks posed by the flaw. Security researchers have confirmed that multiple hacker groups are actively leveraging the PoC to target organizations using vulnerable MongoDB instances, emphasizing the urgent need for patching and mitigation.
Jun 29, 2026
A group of outsourced staff at Ubisoft were bribed by cybercriminals, leading to the compromise and sale of the company's most valuable intellectual property. This incident highlights the growing risk of insider threats, particularly when external contractors are targeted by threat actors seeking privileged access to sensitive assets. The breach underscores the importance of robust vetting and monitoring of third-party personnel, as well as the need for strong internal controls to detect and prevent insider collusion. In a related trend, cybersecurity professionals themselves have admitted to acting as affiliates for the BlackCat ransomware group, leveraging their technical expertise to facilitate attacks. These revelations demonstrate the increasing willingness of individuals with legitimate access and skills to collaborate with cybercriminal organizations, either for financial gain or under coercion. The convergence of insider threats and professional expertise within cybercrime operations poses a significant challenge for organizations seeking to defend against sophisticated, multi-vector attacks.
Jun 29, 2026
Rockstar Games confirmed that attackers accessed a limited amount of **non-material internal company information** through a third-party breach after the **ShinyHunters** group claimed it had infiltrated cloud-connected systems and demanded payment under a "pay or leak" ultimatum. Rockstar said the incident did **not** affect players or core operations, and reporting indicates the intrusion likely stemmed from compromised access tied to analytics vendor **Anodot** and Rockstar’s Snowflake-connected environment rather than a direct breach of Rockstar’s own infrastructure. After Rockstar reportedly did not meet the ransom demand, ShinyHunters said it would publish the stolen data, and subsequent reports said **78.6 million records** were released. Early assessments described the exposed material as internal corporate data such as contracts, financial documents, and marketing plans rather than player information, but the leak still created extortion, confidentiality, and supply-chain risk concerns for the game publisher as it prepares major releases including **Grand Theft Auto VI**.
Jun 29, 2026