Last week, a massive amount of data was stolen from Spider-Man developer Insomniac games. Now the hackers who stole that data have leaked it online, detailing internal plans of the studio that stretch across the next decade.
On December 12, Cyber Daily reported that Insomniac had suffered a data breach committed by ransomware group Rhysida, which posted proof-of-hack documents and stated it would publish the remaining information it had stolen after seven days. A spokesperson for Rhysida told Cyber Daily it had specifically chosen Insomniac as an “easy target” with the intent of demanding money. At the same time, Rhysida ran an auction for that data with a starting price of 50 bitcoins, worth approximately $2 million.
Now a week has passed, and Rhysida has followed through on its threat, posting an enormous amount of Insomniac’s internal data online. This amounts to 1.3 million files totalling 1.6 terabytes of data. The data includes Insomniac’s broad roadmap to the year 2032, footage and art assets of Insomniac’s announced Wolverine game, details of production schedules, game budgets, sales forecasts, and other specific information regarding Insomniac’s business.
More concerningly, the leak also includes personal information about Insomniac’s employees, including employee details and private Slack messages.
Neither Insomniac nor the studio’s owner Sony have commented officially about this most recent leak, but Sony provided a public statement following Rhysida’s hacking claim last week, stating it was “aware” of the reports about the hack, and that it was “currently investigating this situation.”
Make no mistake, this is one of, if not the most, egregious hack on a game developer in the industry’s history, and an extremely serious crime, moreso than the data breach suffered by Rockstar last year, which saw development footage of Grand Theft Auto 6 released onto the Internet.
Sony’s response is likely to be equally serious, although unlike the data breach suffered by Rockstar last year, this isn’t an individual actor who will be easy to track down. The Rhysida group claimed it was behind the recent cyber-attack on the British Library, where it stole user data and placed it for sale on the dark web. The group was also the subject of a cybersecurity advisory jointly published last month by the US Department of Defence, the Cybersecurity and Infrastructure Security Agency, and the Multi-State Information Sharing and Analysis Centre.
