NetworkTigers discusses the rise in video game company hackes.
Video game company hacks are becoming increasingly common, as software developers and hardware manufacturers have found themselves repeatedly hit by large-scale cyberattacks.
Organizations across all sectors and industries are vulnerable to hackers searching for valuable data they can sell on the dark web or use as leverage in a ransomware attack. However, the recent uptick in attacks specific to the gaming industry is cause for concern.
Why do hackers target video game companies?
Successfully executed video game company hacks offer two foundational incentives that make them appealing to hackers: they give criminals access to massive amounts of user information and confidential intellectual property that publishers worth billions of dollars are desperate to prevent from being publicly exposed or auctioned off online.
According to a 2021 report from security firm BlackCloak, game developers also do not need to follow strict guidelines regarding protecting customer data. While hospitals and banking institutions are highly regulated, video game companies are not legally required to be as proactive about security.
The gamer demographic skews young. Many teenage or adolescent users socialize in an online environment where privacy is not a priority. The frequency of cyberattack headlines serves as background noise amidst more interesting or impactful content.
People with less concern regarding best security practices tend not to adhere to password hygiene, for example, and often use the same one across multiple accounts. If a player’s credentials are stolen in a hack carried out against a gaming platform they frequent, their access across other gaming, banking, and social media services is also at high risk for being taken over.
This domino effect is lucrative from a hacker’s point of view and means that it is easy to use an attack on one platform can easily be used to launch offensives on others.
Notable video game company hacks
Nintendo
In the 2020 Nintendo hack, 300,000 users may have been exposed. Players found themselves locked out of their accounts, and some of those connected to the platform to PayPal saw purchases made on their behalf.
Characteristically enigmatic on issues unrelated to the lighthearted fun of their offerings, Nintendo did not reveal the nature of the hack. However, their assurance that company databases remained safe and their insistence on users opting for better, stronger passwords imply that phishing, credential stuffing, or some other brute force technique was employed.
Rockstar Games
On September 18, 2022, a user on a forum dedicated to Rockstar Games’ Grand Theft Auto series posted a trove of video files showing footage of the publisher’s upcoming sixth entry into the franchise. According to the hacker, they obtained the files after breaking into Rockstar’s internal Slack message board.
Furthermore, the hacker could dig deeper into the company’s network and steal source code related to the immensely popular Grand Theft Auto 5 and the aforementioned Grand Theft Auto 6. While details become scant at this point, it is believed that the hacker sold the source code online just before their arrest in Oxfordshire, England.
The 17-year-old individual associated with the bold Lapsus$ cybercrime group is also implicated in hacks against Uber and Microsoft.
Axie Infinity
Axie Infinity had the unfortunate distinction of combining crypto and gaming, offering hackers an irresistible target.
In 2022, Axie Infinity was breached by criminals associated with the Lazarus and APT38 North Korean hacker collectives.
The criminals reportedly targeted high-ranking Axie Infinity employees with fake job offers in PDF files containing malicious code.
The hack saw the platform’s userbase drained of a staggering $620 million in crypto, undoubtedly funneled to the North Korean government, which has found massive online theft to be an effective means of generating income.
2K
2K, the publisher responsible for titles such as BioShock and NBA-licensed basketball games, saw an unauthorized user gain access to its support platform and send a fraudulent email to several users in September of 2022.
The email contained a malicious attachment in the form of a malware variant called RedLine Stealer. RedLine Stealer can grab passwords stored in web browsers, banking data, cookies, crypto wallet credentials, and more.
2K urged users to change their passwords and delete any correspondences purporting to be from the company’s support team.
Bandai Namco
In July 2022, Bandai Namco was attacked by the BlackCat ransomware gang.
BlackCat became internationally relevant after its members’ involvement in the hack of the Colonial Pipeline.
For their part, Bandai Namco has been less than forthcoming when it comes to keeping the public informed on the fallout from the incident, with a single September update from the company merely stating that their investigation is ongoing and that they can neither confirm nor deny whether or not customer data was accessed or stolen in the attack.
The statement has not sat well with security experts and researchers, who feel that the company is offering little to no reassurance to its users.
The future of video game industry cyberattacks
With the gaming industry growing exponentially and finding itself on the event horizon of widespread virtual and augmented reality adoption, it’s reasonable to believe that developers will continue to see attacks lodged against them in ways that will likely affect the privacy and security of users in unprecedented ways.
To keep customers safe, experts agree that companies must be proactive about putting security protocols in place before disaster strikes.
With so many headline-grabbing intrusions just this year alone, one might assume that the public would also be demanding greater responsibility from companies entrusted with their data.
However, the landslide of cyberattack headlines seems to have the opposite effect. The general population appears numb from so many consecutive hacks and unaware of the implications of such activity on their personal and private lives.
Companies across all industries also seem to be noticing peoples’ disinterest. After the initial splash made by a hack and the preceding PR statements, official correspondences from companies intended to keep users privy to ongoing developments are becoming harder to find.
It would appear that the overall corporate strategy in the aftermath of a cyberattack is shifting from describing the event as “highly sophisticated,” implying that it was impossible to have prevented, towards one that sees companies put the incident in the rearview with little pushback from those who may be affected.
So what is a concerned individual to do? As usual, data security and privacy are mainly up to the consumer, especially considering that some of these attacks are successful due to phishing and social engineering plots carried out on users that had the misfortune of falling for a scam.
Use strong, randomized passwords, never use the same login credentials across multiple accounts, and stay aware of current phishing and scam trends.
While these habits may not prevent your data from being stolen if a platform is the victim of a sophisticated hack, they go a long way towards ensuring that you aren’t an easy victim and help to build a solid cybersecurity foundation that benefits everyone.
