Cyber Incident Victim: GSC Game World
Date:
Mar 2023
Location:
Ukraine
Summary
GSC Game World, developer of the anticipated 'STALKER 2' game, suffered a breach where Russian hacktivists compromised an employee account for a work application, stealing outdated and in-development game assets including storyline details, concept art, and maps. The attackers threatened to leak tens of gigabytes of data unless demands were met, including policy changes toward Russian and Belarusian players, reinstating a banned Discord user, and implementing Russian localization. The company stated it faced persistent cyberattacks aimed at disrupting development and damaging its reputation, downplaying the impact by asserting the stolen materials do not reflect the final product’s quality and urging the community to avoid sharing leaked content.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 12, 2023, Ukrainian game developer GSC Game World disclosed a security breach impacting its systems during the development of "STALKER 2: Heart of Chornobyl." The company attributed the attack to a Russian-based social media community that compromised an employee’s account for a collaborative image-processing application. Threat actors stole game-related assets and issued blackmail threats to coerce policy changes, marking the latest in a series of sustained cyberattacks against the studio over more than a year. GSC characterized the incident as part of broader aggression aimed at disrupting production and damaging its reputation amid Ukraine’s ongoing war conditions. Initial evidence indicated the attackers accessed outdated and incomplete development materials, including concept art, storyline documents, and mapping data. The company issued a public statement on Twitter urging its community to avoid viewing or sharing any leaked content and emphasized that the compromised materials did not reflect the final game’s quality.
The attackers utilized the Russian social media platform VK to claim responsibility, demanding GSC reverse policies restricting access for Russian and Belarusian players, reinstate a banned Discord user ("NF Star"), and implement Russian localization for the game by release or as post-launch content. They threatened to release tens of gigabytes of stolen data—including global maps, cutscene details, and concept art—by March 15 if demands were unmet, framing their actions as opposition to politicizing gaming while acknowledging rival title "Atomic Heart’s" commercial success. GSC reaffirmed its resilience against coercion, noting staff routinely navigate wartime hardships far graver than cyber intimidation. The studio maintained operational continuity, advising players to await the official release for an optimal experience. No further data disclosures or concessions by either party were documented in the immediate aftermath of the ultimatum.