CD Projekt Red says it was hacked but won't pay the ransom

Steve Dent
·Associate Editor
·2-min read

With the bungled launch of Cyberpunk 2077, CD Projekt Red has had a rough couple of months. Now, the company tweeted that it’s been hacked and must pay a ransom or code from games like Cyberpunk 2077 and an “unreleased version of Witcher 3” will be revealed. The attackers have also dumped or threatened to dump “documents related to accounting, administration, legal, HR, investor relations and more.”

The company said that “an unidentified actor gained unauthorized access to our internal network, collected certain data belonging to CD Projekt capital group and left a ransom note the content of which we will release to the public.”

“We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data,” CD Projekt Red wrote in response. It added that although some devices in its network have been encrypted, “our backups remain intact,” and it has secured its IT infrastructure and started restoring data.

The hack could be alarming for another reason, in that parent CD Projekt owns the GoG gaming platform which holds the private information of numerous subscribers. However, it said that “at this time we can confirm that — to our best knowledge — the compromised systems did not contain any personal data of our players, or users of our services.”

CD Projekt Red was hacked before back in 2017, and said at the time in a similar message that the thieves had stolen “documents connected to early designs for the upcoming game, Cyberpunk 2077.” Though nothing much came of that incident, the latest hack sounds more serious.

Even without the attack, the last six months haven’t been pretty for CD Projekt Red. After Cyberpunk 2077 launched with numerous bugs, Sony eventually pulled the game from their console stores and Microsoft offered refunds to anyone who wanted one. Even with all that, however, the game had sold 13 million copies as of late 2020.