Cyber Incident Victim: Ubisoft
Date:
Mar 2022
Location:
France
Summary
Ubisoft experienced a cybersecurity incident causing temporary disruptions to certain games, systems, and services, prompting a company-wide password reset. The organization stated no evidence indicated unauthorized access to player personal information and collaborated with external experts to investigate the breach. Reports suggested potential involvement by the LAPSUS$ ransomware group, which had previously targeted other entities and claimed responsibility for the intrusion, though the company did not confirm this attribution. Services were restored following mitigation efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Ubisoft disclosed a cybersecurity incident on March 10, 2022, which caused temporary disruptions to some games, systems, and services earlier that month. The company’s IT team responded by collaborating with external cybersecurity experts to investigate the breach. As a precautionary measure, Ubisoft mandated a company-wide password reset for its systems, though no additional security protocol changes were publicly announced. The gaming firm maintained that its investigation found no evidence of unauthorized access to or exposure of player personal information. Services and games reportedly resumed normal operations following the incident, with Ubisoft emphasizing no lasting impact on user data.
The LAPSUS$ ransomware gang was implicated in the attack by media reports, with The Verge citing the group’s alleged claim of responsibility. LAPSUS$ had previously targeted Nvidia in February 2022, exfiltrating approximately 1TB of data including hashed employee credentials. A Telegram message attributed to the group referenced internal disputes over financial demands related to the Nvidia breach, though the post was later deleted. This incident marked Ubisoft’s second publicly disclosed cybersecurity event within four months, following a December 2021 attack targeting infrastructure supporting *Just Dance*, which the company attributed to a resolved misconfiguration. Ubisoft did not confirm LAPSUS$’s involvement in the March 2022 incident but acknowledged the disruption without elaborating on technical specifics or attacker methodologies.