On 9 February 2021, the studio behind The Witcher and Cyberpunk 2077 announced it had been hit by ransomware — and the attackers had already auctioned its source code. The hackers’ ultimatum to CD Projekt Red read like an in-game quest terms reversal: cooperate, or your unfinished games and internal documents leak. The studio refused to pay, and the incident became the definitive case study of ransomware against a creative company.
Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
In February 2021, ransomware actors (HelloKitty strain, with the data-theft layer claimed by multiple groups) encrypted CD Projekt Red’s networks and stole source code for Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased version of The Witcher 3 with ray-tracing. The attackers left a ransom note offering an “arrangement” and threatening Source auctions; CDPR publicly refused on 10 February 2021, restored from backups, and the stolen code went to auction anyway — selling for reportedly ~$1M+ in cryptocurrency before the auction vanished. The durable lesson: for creative and IP-driven businesses, ransomware is a data-theft extortion problem first and an encryption-availability problem second; backups fix downtime, but only law enforcement and hard data-handling hygiene touch the leak.
What happened
The intrusion surfaced on 9 February 2021 when CD Projekt Red told the SEC (via a Polish press release) that it had identified compromised systems, encrypted devices, and stolen data. The attackers’ note — which CDPR itself published on Twitter — gave the studio 48 hours, offered to withhold leaked material from “your contacts in the press,” and demanded an unspecified deal for both the decryption of systems and non-release of source code and internal documents (HR, legal, accounting). The stolen set reportedly included full source for Cyberpunk 2077 and The Witcher 3 (including a next-gen ray-tracing build then in development), Gwent card-game code, and internal corporate documents.
CDPR refused to negotiate, announced it had begun restoring data from backups, and involved law enforcement. Almost immediately, the code appeared at auction: first on the Exploit malware-market forum, with a starting bid around $1M and “blitz” buyouts reportedly around $4-7M; an alleged buyer surfaced claiming to have paid, then the auction and threads evaporated. Meanwhile the “HelloKitty” ransomware brand claimed the encryption, though the data-theft side carried fingerprints of Kokomo/other affiliate behaviour, and fragments of the stolen material (documents, code snippets) surfaced on leak sites through 2021. No complete verified public dump of the games ever materialised — a standing curiosity of the case.
The studio shipped things through it: the February 2021 patch cadence for Cyberpunk 2077 continued, though the studio confirmed work-from-home disruption and a hard reset of some internal infrastructure. Financially, CDPR survived; reputationally, the episode is remembered as the moment the games industry realised game-dev pipelines — with decade-spanning codebases, outsourced studio meshes, and sprawling perforce repositories — are prime extortion targets.
How it worked
Full technical forensics were never published, but the incident’s shape aligns with the standard 2021 affiliate playbook: initial access via stolen credentials or an unpatched edge service, internal recon, data staging and exfiltration before encryption, then dual extortion — encryption plus leak threat — with auctions as the pressure mechanism.
CDPR network (Feb 2021)
access (credentials/edge - not publicly detailed)
-> recon: locate source repositories (Perforce), file shares, HR/legal docs
-> EXFILTRATE FIRST (auction inventory)
-> deploy HelloKitty ransomware -> encrypt workstations + servers
-> leave ransom note: source + docs, 48h, "press contacts" threat
|
CDPR: public refusal (Feb 10) - restore from backups
attacker:auction on Exploit forum -> bids ~$1M+ -> vanishes
fragments leak through 2021; full dump never verifiedTwo aspects deserve shelf-space. First, the auction mechanism itself: selling exclusive stolen IP to third parties (often competitors or re-sellers) monetises data that has no liquid market — an evolution beyond the leak-site model. Second, the target economics: game studios hold irreplaceable artefacts (source for unshipped titles) whose value decays slowly, giving attackers longer leverage timelines than typical corporate data. Both now standard considerations in entertainment-industry threat modeling.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Public disclosure / refusal | 2021-02-09 / 2021-02-10 | CDPR press releases + tweet |
| Ransomware strain | HelloKitty (encryption); data-theft actor layered | industry analysis (Emsisoft, others) |
| Stolen IP scope | Cyberpunk 2077, The Witcher 3 (+next-gen build), Gwent source; internal documents | auction listings/CDPR statements |
| Auction figures | starting bid ~$1M; buyout reportedly $4–7M; alleged sale then disappearance | Exploit forum posts (via reporters) |
| Recovery approach | Backups; no ransom paid | CDPR statements |
| Complete public dump | Never verified | leak-site monitoring through 2021 |
Timeline
| Date | Event |
|---|---|
| 2021-02-09 | CDPR discloses ransomware; publishes attackers’ note |
| 2021-02-10 | Studio refuses demands; restoration from backups begins |
| 2021-02-11 | Stolen code auction appears on Exploit forum (~$1M start) |
| 2021-02 (late) | Auction vanishes; alleged buyer claims purchase |
| 2021 (year) | Document fragments leak; full game code never surfaces publicly |
Why it still matters in 2026
CDPR set the template answer for an extortion target with unique assets: refuse publicly, restore independently, accept the leak risk. It worked — no verified full dump ever landed — but only because the stolen material’s commercial market was thin. Modern variants of this story (game studios, media archives, AI model weights in 2024–2026) face thicker stolen-goods markets, which is why IP-intensive firms now pre-position legal takedown capacity and watermark their internal artefacts. The strategic frame is in our ransomware decade retrospective; incident-playbook mechanics live in the CISO response checklist and the first-24-hours playbook.
Detection and hardening takeaways
- Segment source-control from corporate IT. Perforce/GitLab repositories holding crown-jewel IP deserve their own identity boundary, MFA, and egress-controlled enclave.
- Assume exfil-before-encrypt. Detection windows centre on staging: unusual archive creation, bulk reads of repository storage, and off-hours data movement to cloud storage.
- Rehearse the no-ransom path. Backups, legal counsel, and comms need a pre-agreed script for the hour after refusal — CDPR’s calm execution is the model.
- Watermark and canary internal artefacts. Traceable code builds and document canaries turn any later leak into evidence and early warning.
- Plan auction response legally. Pre-agree takedown counsel and forum-monitoring relationships; speed decides whether an auction gains traction.
FAQ
Did the full Cyberpunk source code ever leak?
Not verifiably. The auction winner — if the sale was real — never published, and no complete, authenticated dump appeared on leak sites through 2021. Fragments and internal documents did circulate. The incident is a rare case of stolen crown-jewel IP effectively staying bottled.
Why did CDPR publish the ransom note?
Transparency as strategy: publishing the note signalled to employees, partners, and players that the studio would not pay, pre-empting weeks of speculation and removing the attackers’ information advantage. It also publicly framed the incident as extortion, which shaped the legal and law-enforcement response.
What is HelloKitty ransomware?
A RaaS strain first observed in 2020, named after its lock-screen theme, used by affiliates against mid-size targets; in CDPR’s case it handled encryption while the data-theft/auction side showed multi-actor fingerprints. The brand churned through 2021 via rebrands and forum takedowns — typical lifecycle for RaaS labels.
Source-code extortion and the studio defense stack
The CD Projekt Red ransomware — source code stolen and auctioned, auction flopped, data leaked — belongs to the IP-extortion lineage this series documents through the GTA VI leak and the Lapsus$ era: attackers monetizing unreleased creative and engine assets whose market value proved far lower than imagined, because stolen source does not confer the ability to ship the game. The auction failure taught the criminal market a pricing lesson, and the leak taught studios a continuity one.
The studio defense stack formalized from the era: compartmentalized development estates with per-project access rather than company-wide trust (limiting any single compromise to a slice of the portfolio); collaboration-platform governance matching the Slack-vault lessons; watermarking and canary artifacts in codebases so leaks trace to their disclosure point; and the leak-response kit distinct from incident response — takedown operations, community management, and the communications posture that treats partial leaks as survivable narrative events rather than existential ones.
The consolidation: CDPR shipped the affected game, the leaked engine code circulated without catastrophic consequence, and the incident joined the record as evidence that IP extortion succeeds against operational continuity far more reliably than against asset value — attackers kept the technique for its disruption leverage, and studios kept hardening for exactly that reason. The auction flopped; the lesson did not.
The auction aftermath also settled an industry question: stolen source code, contra intuition, trades at thin margins — engines require institutional context to exploit, game code requires shipping infrastructure, and buyers with real capability generally prefer building to laundering hot assets. Extortion value concentrates in operational disruption and confidentiality stakes rather than asset resale, which redirects studio defense budgets toward continuity and leak-response (the high-leverage targets) rather than code-obfuscation theater (the low-leverage one). CDPR priced the lesson publicly; every subsequent studio budget could read the receipt.
Continuity and leak-response as the high-leverage targets; obfuscation as theater; the receipt published, the budget redirected — the studio defense market correcting on public evidence.
The watermarking and canary dimension deserves its closing note as the under-deployed half of the studio stack: codebases seeded with unique markers and honeytoken credentials convert leaks from unattributable events into traceable ones, and the tracing capability itself deters the insider-adjacent leakage that external controls cannot reach. The technique is decades old, trivially cheap relative to the compartmentalization architecture, and absent from most studios despite the era demonstrating that leaks were the end-state of every extortion regardless of payment. The defense stack has a cheap layer sitting visibly unadopted — the recurring pattern of this entire record, in miniature.
- Change Healthcare ALPHV: The Ransomware That Broke US Healthcare
- ESXiArgs: The Ransomware Wave That EncryptEd Whole Estates
- Guardian Ransomware: The Newsroom That Kept Printing
