CD Projekt Red refuses to give in to ransom demands, Hackers auction Witcher 3 and Cyberpunk 2077 source codes

Earlier this week, CD Projekt Red became the victim of a cyberattack. Sensitive data, along with source code of games such as Cyberpunk 2077 and Witcher 3, were stolen from the developers.

It is being reported that the source code has now been sold in a dark web auction.

This is the source code to 'Gwent' card game. Witcher 3, CyberPunk 2077, etc is being auctioned today on EXPLOIT forums at a starting bid of $1,000USD.The ransomware authors said they will not be auctioning data anywhere else - any other location other than EXPLOIT is fake.

— vx-underground (@vxunderground) February 10, 2021

While still unconfirmed, multiple cybersecurity experts have suggested that the ransomware attack came from a group called "HelloKitty." Gamers had previously argued that the cybercrime was carried out by some frustrated gamer(s).

Before CDPR the same group has hacked the Brazillian energy company CEMIG late last year. Earliest victims date back to November 2020, way before CyberPunk was even released. I can see the appeal of the "this was revenge by a former fan", but life is much more boring than that.

— Fabian Wosar (@fwosar) February 9, 2021

In a random note delivered to CD Projekt Red, the group stated:

"If we do not come to an agreement, then your source codes will be sold or leaked online, and your documents will be sent to our contacts in gaming journalism. Your public image will go down the gutter even more, and people will see how your company functions. Investors will lose trust in your company, and the stock will dive even lower. You have 48 hours to contact us."

Suffice to say, the group kept their word and went through with selling the stolen files as CD Projekt Red was unwilling to give in to the demands. The company has also approached the relevant authorities for a full investigation.

In an interview with IGN, Victoria Kivilevich, a threat intelligence analyst at KELA, explained that all of the files stolen were likely sold in a single package deal.

As of now, it's unclear who the buyer is or what they intend to do with CD Projekt Red's files.

Just in: #CDProjektRed AUCTION IS CLOSED. #Hackers auctioned off stolen source code for the #RedEngine and #CDPR game releases, and have just announced that a satisfying offer from outside the forum was received, with the condition of no further distribution or selling. pic.twitter.com/4Z2zoZlkV6

— KELA (@Intel_by_KELA) February 11, 2021

Further reports suggested that the purchase was made for the price of $7 million.

---

The fate of CD Projekt Red

Adam Kiciński, CEO of CD Projekt Red, stated that the attack will have repercussions in the short term and impact the pace of development.

Since the identification of the buyer is unknown, there is no telling how, when, or where the source code will be misused or implemented.

A concerned Netizen, who goes by the name of 'H240909' on Youtube wrote this:

"For those confused what danger the source code being out in the wild could mean if hackers have the source code of a program, they could potentially find exploits to hack people's systems whenever they run said program.

Fans are still under the impression that CD Projekt Red itself bought back the files in a one-time deal.

Here's what Twitter users are saying on the matter:

If you think a company would actively try to lower their own share valuation, you have a lot to learn.

— rivermist (@remnantquest) February 9, 2021

Genius move since they could have paid it right from the start and saved a lot of time.Nah it's not CDPR.

— GALF_Plays (@GalfPlays) February 12, 2021

Big time - it's cancel culture - every one is giving in to societal pressures and appeasing the publics opinion so they know they had them by the balls

— Nick Medina (@Bluphoenicks) February 11, 2021

pic.twitter.com/PRa9LHaa6r

— CallSaul (@NSFWforYou) February 11, 2021

An investigation is still underway to track down the hackers. The more concerning issue is what the unidentified person or group plans to do with the source code of CD Projekt Red's game. Only time will tell how this plays out.