Stolen CD Projekt data including Cyberpunk’s source code has reportedly leaked

Data stolen from Polish studio CD Projekt has reportedly been leaked online, including the source code for Cyberpunk 2077, The Witcher 3 and more.

CD Projekt Red first revealed in February that it had fallen victim to a targeted cyber attack. In a statement, the developer said some of its internal systems had been compromised and “certain data” stolen.

The stolen data was said to include the source code files for CD Projekt Red’s game development engine, RedEngine, and titles including The Witcher 3: Wild Hunt, an upcoming ray-traced version of The Witcher 3, Thronebreaker: The Witcher Tales and Cyberpunk 2077.

The data was originally put up for auction on the dark web with a starting price of $1 million and a buy now price of $7 million, but the seller pulled the lot, with the condition of no further distribution or selling, after receiving an outside offer which was deemed to be satisfactory, cyber intelligence firm Kela reported.

Now, according to databreaches.net, the same data from the CD Projekt breach has been shared online. According to an alleged text file posted on the Resetera forum, the alleged files are password protected, with the password being shared with users in exchange for a $10 donation.

It’s claimed that the group has shared software developer kits for PS4, PS5, Switch and Xbox Series X without password protection in order to prove its legitimacy. One Resetera user claims to have obtained these files.

The ransomware attack on CD Projekt Red was allegedly carried out by a group called HelloKitty, which is said to have posted the source code of CD Projekt Red’s Gwent card game online prior to the auction earlier this year.

The culprits claimed they had stolen source code for the aforementioned games as well as documents relating to the company’s accounting, legal, HR and more.

If CD Projekt Red did not “come to an agreement” with them within 48 hours, the culprits said they would sell or leak the content.

CD Projekt Red said it would not give in to the demands and that it had approached relevant authorities including law enforcement and IT forensic specialists.

Last week, CD Projekt stated that it’s still awaiting Sony’s approval to bring the game back to the PlayStation Store, over five months after it was delisted.

The furore surrounding the game’s launch issues have led to legal action. The Witcher developer confirmed last week that four class action lawsuits brought against it over Cyberpunk 2077’s launch have been consolidated.