Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
Sometimes an early release means theft. Over the past decade, several major video-game studios have suffered large-scale data breaches that exposed unreleased builds, story assets and internal documents long before official launch dates.
In December 2023 the ransomware group Rhysida breached Insomniac Games through a single remote employee who clicked a phishing link. The attackers stole a very early dev-build of Marvel’s Wolverine, a large set of assets from the then-upcoming Marvel’s Spider-Man 2, employee passport scans and internal communications. After failing to receive a 50-Bitcoin ransom, Rhysida published the material. Brazilian pirates later turned the Spider-Man 2 assets into a fully playable PC build that circulated months before Sony’s official 2025 PC release.
A similar external breach hit Naughty Dog when attackers exploited an old vulnerability in the studio’s AWS infrastructure, originally introduced in patches for Uncharted 3 or the first The Last of Us. The stolen files included fully rendered cutscenes from The Last of Us Part II that revealed major plot points months before release. Sony traced the activity to a 20-year-old individual in the Netherlands; the final legal outcome remains undisclosed.
Rockstar Games has endured repeated leaks. In 2013 an Amazon logistics error allowed physical copies of GTA V to reach stores early, resulting in a complete Xbox 360 build appearing online four days before launch. The most damaging incident occurred in September 2022 when British teenager Arian Kurtaj used social-engineering techniques against Rockstar’s Slack workspace to obtain dozens of early GTA VI alpha videos. Kurtaj was later placed in a secure psychiatric facility after also breaching Uber.
The most recent case involves the still-unidentified actor known as Cyberleek, who in August 2024 released approximately 25 minutes of near-final GTA VI gameplay footage while simultaneously promoting a memecoin. The perpetrator combined extortion threats, spoiler auctions and paid watermark advertising before disappearing after Rockstar’s official reveal on Netflix. Rockstar continues to pursue legal action and platform takedowns.
These incidents illustrate recurring attack vectors—phishing, misconfigured cloud storage, supply-chain errors and social engineering—that remain relevant to any studio handling high-value pre-release content.
Related articles
EY Confirms Data Breach Exposing Goldman Sachs and Man Group Client Details via Checkmarx Vulnerability
EY has confirmed a data breach involving client documents accessed through a third-party technology services management platform used to support its tax operations. The unauthorized access occurred via a vulnerability in Checkmarx software and lasted from March 28 to April 12, with detection only on April 23. Exposed information included names, addresses, tax identification numbers, email addresses, and financial details belonging to clients in Goldman Sachs wealth management and the Man Group investment fund. Neither Goldman Sachs nor Man Group systems were compromised, confirming the exposure originated solely from EY's environment. The leaked materials consisted of attachments from support tickets rather than core system data. EY has engaged independent security firms, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring to affected individuals.
ThreatMon Exposes SQL Server xp_cmdshell Abuse Stealing Credentials from Viva Aerobus
Researchers at ThreatMon discovered an exposed attacker infrastructure containing 17 attack tools and data stolen from airline Viva Aerobus. Attackers gained operating system access through the xp_cmdshell feature in SQL Server, which allows execution of system commands when enabled. They issued Windows and encoded PowerShell commands directly through database sessions. Data exfiltration occurred by reading files, splitting content into smaller chunks, converting to Base64, and returning results via normal SQL query responses to avoid network detection. Recovered materials included browser, Windows, and SQL credentials, source code, configuration files, database connection strings, OAuth, email, SFTP, and payment system references, plus connection history from SQL Server Management Studio. Activity took place between September 25 and 29, with no identified initial access vector or link to known malware families.
Times Car Breach Exposes Identity Documents of 1.6 Million Users
Times Mobility, operator of the Times Car car-sharing service under the Park24 group, confirmed a data breach affecting approximately 6.6 million accounts. The intrusion was detected on September 25, 2026, after unauthorized access to the company's systems. Leaked information includes names, addresses, phone numbers, dates of birth, email addresses, driver's license details, and hashed passwords. Most notably, images of identity verification documents were exposed for around 1.6 million accounts, covering driver's licenses, address proofs, student IDs, and family confirmation documents. The company is notifying affected members individually by email and plans further updates based on ongoing investigation results.
German Intelligence Deputy Chief's Personal Data Exposed for Years After LiveAuctioneers Breach
The personal phone number, email address, and home address of Dag Baer, deputy head of Germany's Federal Intelligence Service (BND), remained publicly accessible for several years following a 2020 breach of the American online auction platform LiveAuctioneers. The incident exposed data belonging to 3.4 million users and was uncovered through a joint investigation by Süddeutsche Zeitung and WDR. Baer continued using the compromised phone number until journalists contacted him on September 9, after which he acknowledged the error and stopped using the old number. Similar exposures affected a Bundeswehr general-major based in Bavaria as well as Peter Resink, head of the Dutch military intelligence service MIVD. All cases originated from third-party commercial services rather than direct compromises of intelligence agency systems. The reporting highlights how even senior intelligence officials remain vulnerable to ordinary consumer data breaches when they reuse contact details across personal accounts.