Amid speculation and expectations generated by leaks, the nearly thirty-minute trailer for GTA VI was released in the last week of August. Although the Hacker Group CyberLeek did not obtain its protest demands, its main objective was achieved, withdrawing approximately 1.5 million Brazilian reais from its cryptocurrency $CYBERLEEK.
Following the release of this case on Netflix and the subsequent disappearance of the hacker group, it becomes relevant to better understand this blackmail mechanism and revisit other examples where the gaming sector has been targeted by extortion.
When Wolverine became a hostage
In December 2023, Insomniac Games faced a crisis more severe than just the invasion of its servers by hackers. The responsible group held confidential information about employees, internal documents, and crucially, years of work on titles that had not yet been released to the public.
The demand presented was around US$ 2 million, an amount the company chose not to pay. A few days later, a volume of 1.67 TB of data began circulating on the internet, including materials related to Marvel's Wolverine.
As a point of comparison, a similar incident occurred in the film industry. In 2014, while working with Sony Pictures, there was a data theft where emails, phone numbers, and personal information were exposed on WikiLeaks, revealing details about the Spider-Man movie, including negotiations for the brand acquisition by Marvel at the time.
The central question is how a game still in development can become a tool of coercion against the producing studio itself?
Historically, ransomware attacks operated more directly: criminals would invade companies, block files, and demand payment to restore access. However, the evolution of these attacks introduced what is called double extortion. Attackers now copy files before encrypting them, maintaining the threat of publishing the stolen data even if the victim can use backups.
For a game studio, this threat carries a particular gravity. A title in development represents years of dedication, substantial investments, and information kept confidential until the strategic launch date. Access to a test version (build), source code, or future plans means holding something the studio cannot simply replace.
Thus, the game does not need to be kidnapped in the classic sense; an advance copy is enough. From that point on, what could be the studio's next major release can become an instrument of pressure.
Why are games such an interesting target?
Game studios possess extremely valuable assets for this type of extortion: secrets that arouse immense public interest. Systems contain source code, unannounced games, characters, scripts, development builds, contracts, and multi-year schedules.
There is an important distinction compared to other industries. While the theft of internal documents from a common company might not attract much attention, an unprecedented video of GTA VI or Wolverine quickly spreads across the internet within hours due to public interest.
It is precisely this public engagement that amplifies the power of the threat. For the criminal, the need to find someone willing to buy the stolen files is mitigated by the possibility of simply publishing them, which can already cause enormous damage to the studio, affecting marketing campaigns, scheduled advertisements, and years of secret development.
It wasn't just Insomniac
The Insomniac episode is not an isolated event. In 2021, CD Projekt, developer of Cyberpunk 2077 and The Witcher, suffered an attack where hackers stole source code and internal documents before threatening their disclosure. The company refused to negotiate, and some of the material ended up circulating online.
In the same year, Electronic Arts had about 780 GB of data compromised, including source code for FIFA 21 and tools related to the Frostbite engine. This case didn't even start as a traditional ransomware attack; the data was extracted and subsequently used in an extortion attempt, demonstrating that criminals no longer rely on blocking computers to exert pressure.
Capcom and Rockstar also experienced analogous situations. In the attack on Capcom, systems were breached and corporate and personal information was stolen under the condition of ransom. In the Rockstar case, responsible for GTA, the intruder even threatened to release the source code during negotiations with the company.
Although the methods and targets vary, the pattern becomes progressively identifiable: the invaders' power lies not only in the ability to paralyze the studio but also in possessing information that it cannot allow to become public.
A leak cannot be restored from a backup
A company victim of ransomware can recover servers, change passwords, reinstall equipment, and retrieve files through backups. However, there is something none of these actions can reverse: the secret once it reaches the internet.
For a game studio, this can mean the exposure of years of planning all at once. Unannounced titles, characters, scripts, release dates, and commercial strategies can become public much earlier than the company's established deadline. In the Insomniac case, for example, the leak exposed not only details about Wolverine but also information about the studio's future projects and plans.
Additionally, much of the stolen material was never conceived for public consumption. Prototypes, test videos, and incomplete versions can be evaluated as if they were the final product. This happened with GTA VI, when videos of a development version circulated and were analyzed outside the production context.
For this reason, the damage from a leak transcends the field of Information Technology. Servers can be recovered and failures corrected, but a studio cannot make millions of people forget what they have already seen.
And what is our role in this equation?
The effectiveness of threats to publish information about GTA VI or Wolverine stems from the criminals' knowledge of the existence of a vast public interested in this content. As soon as a leak occurs, images are shared, videos appear on social networks, and forums analyze every detail, causing what should remain internal to the studio to spread across the internet in just a few hours.
It is difficult to expect millions of players to ignore information about a game awaited for years. Curiosity is inherent, and often the public is unaware of the exact origin of an image or video in their feed. However, it is precisely the certainty that this content will be consumed and shared that elevates its value as an extortion tool.
The larger the franchise and the greater the expectation for the next release, the greater the impact of the threat can be. In this sense, the popularity of a game itself ends up working against the studio: what should be its greatest marketing asset helps transform stolen information into a powerful bargaining chip.
Hackers don't just need to steal a secret; for the threat to work, they need to be sure that thousands of people are eager to see it.
When the secret becomes the real hostage
In the past, the biggest fear of a company attacked by ransomware was whether it could recover its files. Currently, for a game studio, an perhaps even deeper concern arises: what happens if everyone can see them?
Attacks targeting Insomniac, CD Projekt, EA, Capcom, and Rockstar demonstrate that it is no longer necessary to prevent a company from operating to exert pressure. It is enough to possess what it dedicated years to keeping secret.
This redefines the concept of digital security for the industry. Protecting a studio involves more than keeping servers operational or ensuring updated backups; it means safeguarding unannounced games, commercial strategies, employee data, and fundamentally, years of work intended for the public at the creators' chosen moment.
As long as there is interest in this information, it will retain value for those who stole it. And the greater the expectation for a game, the greater the power of this threat.
The challenge lies in the fact that restoring systems does not equate to regaining control over what was stolen. A server can be restored, a password changed, a computer formatted. But a secret, once published on the internet, cannot be put back on the server.
Considering the release of the extended gameplay video of GTA VI, it is observed that although CyberLeek profited from its cryptocurrency, there was no apparent impact on the enthusiasm or sales of Rockstar's game, proving that the company's name no longer holds as much assertiveness.