Crimson Collective claims to have hacked Nintendo

Group recently made headlines after breaching Red Hat

Notorious hacking group Crimson Collective has claimed responsibility for a major breach of Nintendo's internal systems.

Crimson Collective says it has access to sensitive production assets, developer files, and backup data. This claim was given weight by cybersecurity intelligence firm Hackmanac which shared a screenshot on X purportedly showing folders labeled "Production Assets," "Dev Builds," and "Backups," allegedly exfiltrated from Nintendo's internal servers.

If authentic, the breach could expose highly confidential information about ongoing game development projects and proprietary tools.

Nintendo has not yet issued an official statement regarding the alleged breach.

The Japanese gaming giant, known for its uncompromising stance on intellectual property protection, has historically taken aggressive legal action against leaks, but the scope and veracity of this latest claim remain unverified.

Crimson Collective has rapidly emerged as one of the most active hacking groups of 2025.

The group recently made headlines after breaching Red Hat, gaining unauthorised access to the company's GitHub repositories and stealing approximately 570GB of data.

Red Hat subsequently confirmed that the attackers attempted extortion but were rebuffed.

Following that attack, Crimson Collective announced on its Telegram channel that it had formed an alliance with ShinyHunters and Scattered Lapsus$ Hunters, two groups with a history of high-impact cyber extortion campaigns. The new coalition announced that they plan to coordinate future attacks and data leaks through a newly established ShinyHunters-operated leak and extortion platform.

The group also posted samples of stolen Red Hat data, including Customer Engagement Reports (CERs), to the platform.

Last month, Crimson Collective also claimed responsibility for a breach of Claro Colombia, alleging the theft of 50 million client invoices and financial records.

Analysts at cybersecurity firm Anomali have suggested that the group is "attempting to establish credibility within cybercriminal circles through high-profile, headline-grabbing attacks."

Investigative journalist Brian Krebs noted that the Telegram posts attributed to Crimson Collective were signed by "Miku", a pseudonym previously used by Thalha Jubair, a 19-year-old UK national and alleged member of LAPSUS$ and Scattered Spider.

Jubair is currently believed to be remanded in custody pending trial.

Attacks targeting gaming industry

The gaming industry has suffered several high-profile breaches in recent years. In 2023, Rockstar Games faced a major hack that led to the leak of early footage and partial source code for Grand Theft Auto VI.

Later that year, Insomniac Games, the studio behind Marvel's Spider-Man, was struck by a ransomware group that released employee information and unreleased game files.

In 2021, CD Projekt Red, creators of Cyberpunk 2077, had its source codes and sensitive corporate data stolen, with the attackers threatening public release if ransom demands were not met.

This alleged Nintendo attack also comes amid a wave of large-scale corporate security incidents.

Just last week, Discord confirmed a data breach via a compromised third-party service provider, exposing names, email addresses, partial payment data, and even scanned government IDs of users who had contacted its Trust & Safety teams.

If you’re a current or aspiring cybersecurity leader check out the Computing Security Leaders Summit on March 26th 2026. Packed with content including business continuity planning, bridging the cyber skills gap and cloud resilience, its promises to be full of insight and practical advice to take away. Register here for your free place.