Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
Sometimes an early release means theft. Over the past decade, several major video-game studios have suffered large-scale data breaches that exposed unreleased builds, story assets and internal documents long before official launch dates.
In December 2023 the ransomware group Rhysida breached Insomniac Games through a single remote employee who clicked a phishing link. The attackers stole a very early dev-build of Marvel’s Wolverine, a large set of assets from the then-upcoming Marvel’s Spider-Man 2, employee passport scans and internal communications. After failing to receive a 50-Bitcoin ransom, Rhysida published the material. Brazilian pirates later turned the Spider-Man 2 assets into a fully playable PC build that circulated months before Sony’s official 2025 PC release.
A similar external breach hit Naughty Dog when attackers exploited an old vulnerability in the studio’s AWS infrastructure, originally introduced in patches for Uncharted 3 or the first The Last of Us. The stolen files included fully rendered cutscenes from The Last of Us Part II that revealed major plot points months before release. Sony traced the activity to a 20-year-old individual in the Netherlands; the final legal outcome remains undisclosed.
Rockstar Games has endured repeated leaks. In 2013 an Amazon logistics error allowed physical copies of GTA V to reach stores early, resulting in a complete Xbox 360 build appearing online four days before launch. The most damaging incident occurred in September 2022 when British teenager Arian Kurtaj used social-engineering techniques against Rockstar’s Slack workspace to obtain dozens of early GTA VI alpha videos. Kurtaj was later placed in a secure psychiatric facility after also breaching Uber.
The most recent case involves the still-unidentified actor known as Cyberleek, who in August 2024 released approximately 25 minutes of near-final GTA VI gameplay footage while simultaneously promoting a memecoin. The perpetrator combined extortion threats, spoiler auctions and paid watermark advertising before disappearing after Rockstar’s official reveal on Netflix. Rockstar continues to pursue legal action and platform takedowns.
These incidents illustrate recurring attack vectors—phishing, misconfigured cloud storage, supply-chain errors and social engineering—that remain relevant to any studio handling high-value pre-release content.
Related articles
FirstVDS Announces Compensation After VMmanager 6 Zero-Day Breach
FirstVDS has detailed compensation measures for clients affected by the October 17 incident involving a zero-day vulnerability in VMmanager 6. Attackers exploited the flaw in the virtualization platform developed by ISPsystem to access portions of the provider's network infrastructure and data belonging to some customers. Clients were forced to reset passwords, keys, and tokens while facing restricted server management and delayed support responses. The company will recalculate charges for unavailable services and issue account balance certificates for support waits exceeding 12 hours, but will not reimburse costs related to credential changes or data compromise. ISPsystem later confirmed the attack targeted a specific build of VMmanager 6 Hosting used by hosting providers, with exploitation aided by Nginx request handling behavior. The vendor released security updates, reworked protective architecture, and collaborated with Kaspersky Incident Response and Kaspersky Threat Research teams.
Four Words Instead of a Password: Why Passphrases Fail Against Real Breaches and Infostealers
Hive Systems' 2026 password cracking table shows an eight-character complex password lasting 132 years under bcrypt, yet human-chosen variants like o#mA24ft fall in three seconds on an RTX 5090. Kaspersky's analysis of 231 million leaked passwords from 2023-2026 reveals 48 percent crack in under a minute and 60 percent within an hour, driven by predictable patterns such as trailing digits, years, and transliterated Russian words. NIST's SP 800-63B-4 update removed mandatory character rules, raised standalone password length to 15 characters, and banned periodic rotation. Diceware passphrases deliver 52 bits with four words and 77.5 bits with six, but only when generated randomly; human-selected phrases from pop culture or song lyrics collapse under dictionary attacks. Infostealers, not offline cracking, dominate theft, with Flashpoint reporting 2.1 billion credentials stolen in cleartext last year. FIDO passkeys reached five billion active keys by May 2026, yet remain vulnerable on compromised devices. The article concludes that passphrases suit only a handful of master secrets while random strings from managers handle the rest.
Beget Hosting Provider Advances Recovery After Cyberattack Wipes Cloud Infrastructure
Russian hosting provider Beget has reported significant progress in restoring services following a major cyberattack that struck its infrastructure on the night of November 2, 2026. Attackers gained access to the management layer and executed wiping scripts, resulting in the complete loss of data in VPS, S3, and Kubernetes environments. File-level backups of VPS instances were preserved, allowing the company to begin phased recovery. Beget has now restored more than 50,000 websites along with their SSL certificates and has completed roughly half of the virtual hosting recovery work. The company expects to finish the main restoration phase within three days. Technical support for affected virtual hosting customers has been enabled directly inside the control panel at cp.beget.com/support, though response times are currently longer than usual due to high ticket volume.
Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach
Notion has confirmed that a security incident at Fireworks AI exposed conversation transcripts from its Notion AI assistant, affecting less than 1% of customer workspaces. The breach occurred because Fireworks handled classification tasks for the Insights feature and served open-weight models. Notion stated that its own systems were not compromised. The timeline shows initial notification on November 2, 2026, followed by disconnection of systems on November 3 and confirmation of customer data exposure on November 8. Most transcripts lacked author or workspace attribution and did not include tool call results, though user-entered content could still identify individuals or organizations. Fireworks attributed the intrusion to a financially motivated group engaged in LLMjacking, involving theft of credentials to hijack AI models for illicit use.