1.6 Terabytes of Insomniac Employee Personal Info Leaked in Historic Data Breach
In a devastating blow to gaming company Insomniac, a massive data breach has occurred, resulting in the leak of 1.6 terabytes of data, including employees’ personal information. The breach was executed by a ransomware group that targeted Insomniac, threatening to sell the stolen data unless a $2 million Bitcoin ransom was paid by Sony. After seven days of negotiations, the hackers followed through on their threat, making 98 percent of the stolen data public.
The scope of the leaked data is staggering, encompassing 1.67 terabytes and 1.3 million files. Among the exposed information are details related to Insomniac’s upcoming Wolverine game, providing a glimpse into plot elements, gameplay footage, and plans. Additionally, internal emails, Slack screenshots, HR documents, a publishing agreement with Marvel, passport scans, and even Insomniac’s game lineup until 2032 have now been exposed.
One particularly alarming aspect of the breach is the inclusion of personal documents tied to Spider-Man actor Yuri Lowenthal. This demonstrates the far-reaching consequences for even those indirectly connected to the company.
The ransomware group behind the attack, Rhysida, states that they specifically targeted Insomniac due to the perception that game developers like them would be an easy mark. Their motivation was purely financial, as they quickly auctioned off the stolen data to the highest bidder. While 98 percent of the data was shared publicly, it is believed that the remaining two percent was sold to an unidentified buyer. It remains unclear whether the leaked employee passports were part of that sold data.
The quantity of data exposed in this breach, equating to 1,670 gigabytes, places it among the largest leaks in gaming history, rivaling infamous breaches such as those affecting GTA 6 and Valve. Predominantly, the leaked files center around the Wolverine game, unveiling test footage, casting choices, plot details, cutscenes, and planning materials. However, interspersed throughout this trove of information are also numerous sensitive HR documents, including I-9 forms and termination records, raising concerns about employee privacy and security.
As Sony launches an investigation into the hack, the ransomware group Rhysida has made troubling claims about the ease with which they accessed Insomniac’s network. According to them, they obtained domain administrator privileges within a remarkably short timeframe of 20 to 25 minutes. The implications of this security vulnerability are alarming, and experts are urging all game developers to reassess their cybersecurity measures.
At present, Sony has not released any official statements regarding this latest leak. The investigation is ongoing, with many concerned individuals anxiously waiting for updates on the situation. The fallout from this breach serves as a stark reminder of the critical importance of robust cybersecurity practices in the gaming industry and beyond.
