Loading story…
Insomniac Games said it was the victim of a ransomware attack after the Rhysida gang published stolen material that reportedly included employee personal data and internal company files. The studio described the incident as "extremely distressing," said it was working quickly to determine what data was affected, and notified current and former employees whose information may have been exposed. Reports on the leak said the dumped files also contained development material tied to upcoming projects, intensifying the impact beyond privacy risks.
The breach added Insomniac, a Sony-owned game developer known for the Marvel's Spider-Man franchise, to a growing list of entertainment and technology companies hit by extortion-driven intrusions. Public reporting indicated the attackers had attempted to auction the stolen data before releasing it, a tactic increasingly used by ransomware groups to pressure victims even when encryption is not the primary disruption. The incident highlighted the dual business risk of modern breaches: exposure of sensitive workforce records and theft of commercially valuable intellectual property.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Insomniac Games publicly acknowledged a data breach and described it as extremely distressing. The statement confirmed the company was responding to the incident after reports of stolen data surfaced.
A report alleged that Ubiquiti suffered a breach that could put many cloud-based devices at risk of takeover, raising concerns about the security of customer environments. The article was later retracted, but the reported breach allegation itself marked the key development.
Reports emerged that Kremlin official Vladislav Surkov had been hacked, with the incident described as a potentially significant shift in cyber conflict involving Russia. The disclosure drew attention as a notable geopolitical cyber event.
A large internet outage tied to DNS provider Dyn disrupted access to major online services and prompted investigation into possible causes. U.S. officials, including the Department of Homeland Security, began looking into the incident.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
videogameschronicle.com
Open sourcearstechnica.com
Open sourcetime.com
Open sourcetime.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rockstar Games confirmed that attackers accessed a limited amount of **non-material internal company information** through a third-party breach after the **ShinyHunters** group claimed it had infiltrated cloud-connected systems and demanded payment under a "pay or leak" ultimatum. Rockstar said the incident did **not** affect players or core operations, and reporting indicates the intrusion likely stemmed from compromised access tied to analytics vendor **Anodot** and Rockstar’s Snowflake-connected environment rather than a direct breach of Rockstar’s own infrastructure. After Rockstar reportedly did not meet the ransom demand, ShinyHunters said it would publish the stolen data, and subsequent reports said **78.6 million records** were released. Early assessments described the exposed material as internal corporate data such as contracts, financial documents, and marketing plans rather than player information, but the leak still created extortion, confidentiality, and supply-chain risk concerns for the game publisher as it prepares major releases including **Grand Theft Auto VI**.
Jun 29, 2026
Capcom disclosed that unauthorized third-party access disrupted parts of its corporate network, affecting internal email and file servers and forcing the company to suspend some network operations to contain the incident. The company said online gameplay services and public websites were not impacted, but investor-relations responses and document requests were delayed while systems were restored and the matter was reported to law enforcement. Reporting tied the intrusion to **Ragnar Locker** ransomware after a related sample and ransom note surfaced, with the gang claiming it encrypted about 2,000 devices and stole more than **1 TB** of unencrypted data from Capcom systems in Japan, the United States, and Canada. The attackers allegedly demanded **$11 million** in bitcoin in exchange for a decryptor, deletion of stolen files, and a network penetration report, while leaked samples were said to include financial records, employee documents, contracts, and internal communications.
Aug 15, 2026
Rockstar Games confirmed it was breached in an extortion campaign attributed to **ShinyHunters**, which claimed it had stolen confidential company data and threatened to publish it unless payment was made by April 14. Early reporting said the attackers may have reached Rockstar data through a third-party service, **Anodot**, with the compromise tied to Rockstar’s **Snowflake** environment rather than a direct intrusion into Rockstar’s own core systems. Subsequent reporting said the attackers allegedly hijacked Anodot authentication tokens to access Rockstar’s Snowflake instance, stealing what Rockstar described as **"non-material company information."** Reports said the exposed data may include corporate documents such as **GTA 6 marketing plans**, while the game’s source code is not believed to be involved. Rockstar said the incident did not affect operations or players, and the case is being viewed as part of a broader pattern of ShinyHunters-linked compromises involving Snowflake environments connected through third-party integrations.
Jun 29, 2026