Ubisoft is grappling with the fallout from a new security breach. This is the latest hacking incident following the massive Insomniac Games hack from earlier this month, raising concerns about the safety of internal data and potential impacts on upcoming video game releases.
According to the French video game publisher, an unknown culprit claims to have breached its systems on December 20 with plans to exfiltrate about 900GB of data. The hackers reportedly gained access to the company’s SharePoint server, Microsoft Teams, Confluence, and MongoDB Atlas panel. Screenshots shared online provided proof of this unauthorized access. Ubisoft confirmed awareness of the alleged data security incident and is currently investigating the matter.
The depth and breadth of the breach remain unclear. While the threat actor boasted of attempting to steal Rainbow 6 Siege user data, they reportedly lost access before they could achieve their goal. This claim, however, has not been fully substantiated, leaving ambiguity about whether any data was successfully extracted.
December 20th an unknown Threat Actor compromised Ubisoft. The individual had access for roughly 48 hours until administration realized something was off and access was revoked.
They aimed to exfiltrate roughly 900gb of data but lost access.
— vx-underground (@vxunderground) December 22, 2023
Ubisoft’s struggles with cybersecurity aren’t new. In 2020, the company found itself targeted by a ransomware gang, which led to the release of part of the source code for Ubisoft’s Watch Dogs game. Another breach occurred last year, disrupting games, systems, and services. This latest breach is the third significant cybersecurity incident the company has faced since 2020.
The timing of this breach is particularly troubling, coming on the heels of the aforementioned data leak at Insomniac. In general, the gaming industry has faced a challenging year marked by layoffs and studio closures. The recent attack on Ubisoft has compounded concerns and highlighted the need for heightened cybersecurity measures across the sector.
The potential impact of this security breach is significant if potentially overblown, based on what others are saying. If confidential details about upcoming games such as Assassin’s Creed, Far Cry, the Splinter Cell remake, and the Prince of Persia remake were accessed, it could lead to premature revelations about Ubisoft’s future projects. Such leaks not only undermine the company’s marketing strategies but also risk exposing sensitive information about developers and other employees.
Of course, the way Ubisoft worded its report suggests that the hacker didn’t succeed in whatever they were trying to get their hands on, or that it isn’t as significant as some would expect.
Either way, Ubisoft advises caution as it tries to get to the root of the matter. This approach is common practice in the management of data breaches, aimed at minimizing damage and assessing the full scope of the intrusion.
With 2024 approaching, video game developers are increasingly focused on bolstering their cybersecurity defenses.
As for what’s next for Ubisoft, it’s currently all-in on the Assassin’s Creed franchise, which is hardly surprising following the success of Assassin’s Creed Mirage. But, it’s releasing other AAA titles in between ventures into the Animus, which recently included Avatar: Frontiers of Pandora, a surprising good game that, sadly, won’t get the credit it deserves. Next on the docket is Star Wars Outlaws, which may or may not be released next year. Finally, Skull and Bones has a release date, which is just right after Prince of Persia: The Lost Prince comes out on January 15, 2024.
