Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
Sometimes an early release means theft. Over the past decade, several major video-game studios have suffered large-scale data breaches that exposed unreleased builds, story assets and internal documents long before official launch dates.
In December 2023 the ransomware group Rhysida breached Insomniac Games through a single remote employee who clicked a phishing link. The attackers stole a very early dev-build of Marvel’s Wolverine, a large set of assets from the then-upcoming Marvel’s Spider-Man 2, employee passport scans and internal communications. After failing to receive a 50-Bitcoin ransom, Rhysida published the material. Brazilian pirates later turned the Spider-Man 2 assets into a fully playable PC build that circulated months before Sony’s official 2025 PC release.
A similar external breach hit Naughty Dog when attackers exploited an old vulnerability in the studio’s AWS infrastructure, originally introduced in patches for Uncharted 3 or the first The Last of Us. The stolen files included fully rendered cutscenes from The Last of Us Part II that revealed major plot points months before release. Sony traced the activity to a 20-year-old individual in the Netherlands; the final legal outcome remains undisclosed.
Rockstar Games has endured repeated leaks. In 2013 an Amazon logistics error allowed physical copies of GTA V to reach stores early, resulting in a complete Xbox 360 build appearing online four days before launch. The most damaging incident occurred in September 2022 when British teenager Arian Kurtaj used social-engineering techniques against Rockstar’s Slack workspace to obtain dozens of early GTA VI alpha videos. Kurtaj was later placed in a secure psychiatric facility after also breaching Uber.
The most recent case involves the still-unidentified actor known as Cyberleek, who in August 2024 released approximately 25 minutes of near-final GTA VI gameplay footage while simultaneously promoting a memecoin. The perpetrator combined extortion threats, spoiler auctions and paid watermark advertising before disappearing after Rockstar’s official reveal on Netflix. Rockstar continues to pursue legal action and platform takedowns.
These incidents illustrate recurring attack vectors—phishing, misconfigured cloud storage, supply-chain errors and social engineering—that remain relevant to any studio handling high-value pre-release content.
Related articles
Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise
Metascan has publicly acknowledged a data breach involving internal materials obtained through a compromised Telegram bot token. The attacker gained access to a corporate Telegram chat for approximately two minutes on September 5 and exported a small set of documents before being removed. The incident stemmed from an overlooked bot token on test virtual machines after an employee departure. Among the leaked items were two pilot project reports from July 2026 that mentioned major Russian organizations including Transneft, Selectel, Lenta, Sberbank, and Rostelecom. Metascan attributed the leak to a former employee now working with a competitor and rejected claims of deliberately hidden vulnerabilities. The company has accepted full responsibility, outlined corrective measures, and launched a bug bounty program.
Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency confirmed that its Government Solution Service (GSS) suffered unauthorized access after attackers exploited a vulnerability in VPN equipment used for external maintenance operations. The intrusion, believed to have begun in late May 2026, allowed threat actors to compromise maintenance accounts and access large volumes of files on internal servers. On June 25, 2026, security teams detected suspicious access to numerous files using a compromised account, prompting an investigation that concluded on July 9 with confirmation of the breach. Some files containing personal information may have been exfiltrated, affecting approximately 246,000 records of government officials, civil servants, contractors, and related individuals. The agency immediately disabled the affected accounts and severed external communications on July 9 but has not disclosed technical details of the exploited VPN vulnerability. The incident was reported by Security NEXT on September 11, 2026.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Dropbox Accounts Compromised Through Lenovo ID Authentication Flaw
Several thousand Dropbox accounts were breached between August 4 and 21 due to an authorization flaw involving Lenovo ID. The root cause was an error on Lenovo's side that permitted registration of accounts using arbitrary email addresses, which could then be used to access matching Dropbox accounts. Dropbox responded by forcing logouts for all users who had relied on Lenovo ID and by requiring direct password entry for Dropbox credentials. Approximately 5,000 accounts were affected, though only about one-third saw stored files accessed by attackers. Accounts protected by two-factor authentication remained unaffected. Additional reports from the same period covered Kaspersky analysis of ValleyRAT spyware using DLL sideloading, a critical SQL injection vulnerability in the All-in-One WP Migration WordPress plugin, and a Google Chrome update addressing CVE-2026-85046 in the V8 engine.