Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
Sometimes an early release means theft. Over the past decade, several major video-game studios have suffered large-scale data breaches that exposed unreleased builds, story assets and internal documents long before official launch dates.
In December 2023 the ransomware group Rhysida breached Insomniac Games through a single remote employee who clicked a phishing link. The attackers stole a very early dev-build of Marvel’s Wolverine, a large set of assets from the then-upcoming Marvel’s Spider-Man 2, employee passport scans and internal communications. After failing to receive a 50-Bitcoin ransom, Rhysida published the material. Brazilian pirates later turned the Spider-Man 2 assets into a fully playable PC build that circulated months before Sony’s official 2025 PC release.
A similar external breach hit Naughty Dog when attackers exploited an old vulnerability in the studio’s AWS infrastructure, originally introduced in patches for Uncharted 3 or the first The Last of Us. The stolen files included fully rendered cutscenes from The Last of Us Part II that revealed major plot points months before release. Sony traced the activity to a 20-year-old individual in the Netherlands; the final legal outcome remains undisclosed.
Rockstar Games has endured repeated leaks. In 2013 an Amazon logistics error allowed physical copies of GTA V to reach stores early, resulting in a complete Xbox 360 build appearing online four days before launch. The most damaging incident occurred in September 2022 when British teenager Arian Kurtaj used social-engineering techniques against Rockstar’s Slack workspace to obtain dozens of early GTA VI alpha videos. Kurtaj was later placed in a secure psychiatric facility after also breaching Uber.
The most recent case involves the still-unidentified actor known as Cyberleek, who in August 2024 released approximately 25 minutes of near-final GTA VI gameplay footage while simultaneously promoting a memecoin. The perpetrator combined extortion threats, spoiler auctions and paid watermark advertising before disappearing after Rockstar’s official reveal on Netflix. Rockstar continues to pursue legal action and platform takedowns.
These incidents illustrate recurring attack vectors—phishing, misconfigured cloud storage, supply-chain errors and social engineering—that remain relevant to any studio handling high-value pre-release content.
Related articles
OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach
OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.
Moscow Court Places Dodo Pizza Cyberattack Suspect Denis Fridman Under House Arrest Until 2026
The Tverskoy District Court of Moscow has ordered Denis Fridman to remain under house arrest until December 8, 2026, in connection with a cyberattack on Dodo Pizza that occurred in late September. Fridman faces charges under paragraphs a and v of part 3 of Article 272.1 of the Russian Criminal Code, which covers the illegal circulation of computer information containing personal data. Investigators detained three of the four suspects after Fridman failed to mask his real IP address while accessing the stolen dataset. The breach lasted two days, but Dodo Pizza quickly blocked access and confirmed that payment details were not compromised because the company does not store them. Authorities notified Roskomnadzor of the incident and implemented measures to forcibly terminate active user sessions where necessary. House arrest remains a preventive measure, and Fridman’s guilt has not yet been established by the court.
Yandex Disk Data Center Incidents Leave Photos and Videos Inaccessible, Custom Recovery Tool Emerges
Following incidents at Yandex data centers in Sasovo and Vladimir, large numbers of photos and videos stored on Yandex Disk became unavailable for normal download. The company attributed the restrictions to load reduction, yet analysis indicates permanent loss of certain data clusters with no confirmed backups. Photos remain partially recoverable through lower-resolution S3 copies such as XXXL and XXL, while videos suffer from missing byte ranges that produce truncated or corrupted files. A researcher developed a specialized tool using mitmproxy to intercept browser requests and download available file variants in parallel streams. The utility also attempts block-by-block video retrieval to salvage whatever segments remain accessible. Users are warned that continued use of the tool may violate service terms and risk account suspension. The developer advises downloading data immediately rather than waiting for potential further degradation.
AT&T to Pay $177 Million to Settle Two 2024 Customer Data Breach Class Actions
AT&T has agreed to pay a total of $177 million to resolve two separate class-action lawsuits stemming from major customer data leaks that occurred in 2024. The settlement, approved on October 2 by Judge Sidney Fitzwater in the Northern District of Texas, allocates $149 million to the first breach and $28 million to the second, covering compensation, attorney fees, and administrative costs. The first incident, disclosed on March 30, 2024, exposed personal information of 73 million individuals, including names, addresses, phone numbers, dates of birth, account passwords, billing numbers, and Social Security numbers for some victims, with records dating from 2019 or earlier found on the dark web. The second breach originated from unauthorized access to AT&T’s Snowflake cloud environment between April 14 and 25, 2024, affecting nearly all mobile customers and revealing call metadata such as phone numbers, interaction counts, durations, and cell tower identifiers from May to October 2022 plus January 2023. No evidence of direct system intrusion was found in the first case, and the second exposure did not include Social Security numbers or call content. Individual claimants can receive up to $5,000 or $2,500 respectively for documented losses, with the claims deadline set for December 18, 2025. AT&T settled without admitting any wrongdoing or liability.