Nintendo breached: Attacker demands small potatoes

Hacker asks for modest fee for modest breach

A threat actor claims to have breached Nintendo and stolen 10 years of corporate data.

The culprit, ShadowByte$, is a relatively new presence in the hacking community, first appearing in February this year.

Posting about the theft on a hacking forum, the attacker claimed to have pilfered 859MB of data from Nintendo. It is demanding a $2 million ransom payment to prevent the information’s release.

While the amount of personally identifying information in the trove of mostly internal records is limited, it does contain data with varying levels of sensitivity.

Researchers who have reviewed the leaked samples say they appear to include employee names and email addresses, HR surveys, workplace feedback, organisational performance metrics, internal reports and planning documentation.

While the samples have not yet been verified as genuine, researchers at Cybernews were able to identify individuals referenced in the files who are apparently still employed at Nintendo.

The researchers confirmed some the data appears to date back to 2016. The associated metadata appears to have been created on the 28^th January this year.

At present it is unclear if ShadowByte$ breached Nintendo directly, or if this is a supply chain attack – perhaps through a third-party HR provider.

The threat actor does reference employee engagement platform TinyPulse, which organisations use to collect feedback and track sentiment.

TinyPulse has not yet responded to requests for comment.

The claimed breach shows that small criminal groups are following in the footsteps of larger, well-known actors like Lapsus$, which in recent years have not settled for simply locking systems and demanding ransoms. By both locking down and stealing data, then demanding money to destroy it, they have found a way to get paid twice for the same attack.

Of course, there are no certainties when dealing with criminals. Law enforcement agencies frequently warn that there is no guarantee they will actually delete the data they have stolen, and the advice – as ever – is not to pay.