Friday, February 12th 2021

CD Projekt Red Hack: Red Engine, Multiple Games' Source Code Sold by Hackers

As if CD Projekt Red needed any more problems on their plate that weren't of their own creation, it seems that the hackers who recently infiltrated the company's infrastructure have turned out a profit on sensitive data. After source code for CD Projekt Red's Red Engine, Cyberpunk 2077, The Witcher 3, and Gwent were stolen from the company's servers, the company announced they had gone to the relevant authorities, and that they wouldn't negotiate with the data terrorists. Now, according to Cybersecurity company Kela, the hackers have de-listed their auction for the data - after requiring a starting bid of $1 million, and expecting $7 million for the entire package.

The deal apparently went through, with a condition that bars the hackers from re-selling the data to any other parties. It remains to be seen whether or not the thieves will abide by their word and the conditions reportedly set upon the sale. Of course, it is in the realm of possibility that CD Projekt Red themselves acquired the data anonymously so as to protect their corporate and technology interests - one can only imagine the repercussions of the company's efforts being exposed this way. And despite any ill sentiment that can be levied at the company for the state of Cyberpunk 2077's last-gen versions, I'd say that respect for the company's developers and team should have us all on their side on this one.
Sources: Kela @ Twitter, via TechSpot
Add your own comment

64 Comments on CD Projekt Red Hack: Red Engine, Multiple Games' Source Code Sold by Hackers

#26
AltCapwn
Working in IT / Security, I wouldn't want to be in CD Projekt red shoes.
At this point, I just hope for them they bought back their own data.

Poor bastards.

Concerning Cyberpunk 2077, their mistake was to give a release date instead of leaving it TBD until ready.
I personally still love the game as I didn't drank all their marketing bullshit and false promises so my expectations weren't high.
But from playing the game you can clearly see that some quests aren't finished, some features are missing, some gameplay systems are broken and unfinished, but damn story wise it's "CD Projekt Red" quality.

But I'm SURE they will fix everything, I just remember how Witcher 3 UI was a nightmare on release, and the missing features could be released as *free* DLC I hope.

Second playthrough as of now, trying to get the secret ending.

Posted on Reply
#27
ixi
altcapwnWorking in IT / Security, I wouldn't want to be in CD Projekt red shoes.
At this point, I just hope for them they bought back their own data.

Poor bastards.

Concerning Cyberpunk 2077, their mistake was to give a release date instead of leaving it TBD until ready.
I personally still love the game as I didn't drank all their marketing bullshit and false promises so my expectations weren't high.
But from playing the game you can clearly see that some quests aren't finished, some features are missing, some gameplay systems are broken and unfinished, but damn story wise it's "CD Projekt Red" quality.

But I'm SURE they will fix everything, I just remember how Witcher 3 UI was a nightmare on release, and the missing features could be released as *free* DLC I hope.

Second playthrough as of now, trying to get the secret ending.

First they need to fix the current game with all the bugs, glitches. And then only to start thinking of dlc...
Posted on Reply
#28
Meta
Deckers stealing data from the corpos and selling it to the highest bidder? Peak Cyberpunk.
Posted on Reply
#29
AusWolf
ZoneDymo"And despite any ill sentiment that can be levied at the company for the state of Cyberpunk 2077's last-gen versions, I'd say that respect for the company's developers and team should have us all on their side on this one."

yeaaahhhhhh no, I dont even care about the last-gen versions, that is so beyond unacceptable its pathetic, all anyone had to do was start the game up 1 afternoon to figure out it was not ready for release but apperently that was too much work, better cash in on those pre-orders and dont release a new trailer that actually represented to lack of content it has, not even a shadow of the promisses.

Imagine though this being some eleborate scheme to create some sympathy by them being the victims and then have modders go ham on teh source code to fix the game for them, ez money for no effort.
CDPR botched the CP77 launch, true, but how can you connect individual opinion of a game to the fact that the source code of some highly successful games were stolen and potentially sold? Even if it was EA (a company whose business practices are hated by almost everyone), I would still side with them. Theft of one's intellectual property is not the answer to anything.

It's like reading the news of a murder and commenting: "well deserved, the victim was a fat bastard anyway". Disgraceful.
Posted on Reply
#30
Vario
I could potentially see Chinese region specific games with elements of the stolen code given China's history of IP theft, but otherwise its going to be hard to sell any product based on this code.
Posted on Reply
#31
AltCapwn
VarioI could potentially see Chinese region specific games with elements of the stolen code given China's history of IP theft, but otherwise its going to be hard to sell any product based on this code.
ChinesePunk 2077; in a dystopic society ravaged by an opressing government and an ongoing pandemic, our hero falls into criminality as its his only way to survive without any job and revenue.
Posted on Reply
#32
Palladium
VarioI could potentially see Chinese region specific games with elements of the stolen code given China's history of IP theft, but otherwise its going to be hard to sell any product based on this code.
As someone at Ars commented, why would they do that when they will have a much easier job developing with Unity and UE4?
Posted on Reply
#33
DeathtoGnomes
ixiDont agree with your opinion. The more time you have the more possibilities you can add and polish them.
See, now that depends on the publisher and how hard they're pushing the dev to get it done faster. Most Gamers have no clue what developers can go thru, I was a playtester for 7 days to Die for a while, I can tell you first hand that one person can push back development, there are other various problems, like upgrading [developmental] software or migrating to a new engine and like waiting for other developers to finish their outsourced project.

Polish is the last thing devs worry about until closer to final beta and after release. Devs dont stop developing just cuz a game is released, unless you are TellTale Games.

So no time is not a factor as you put it.
Posted on Reply
#34
Tartaros
As someone commented before, is there any problem if the code is leaked? They have no mp games so no online aspect to be careful with, and people will have to give up on torrenting those games if the torrents were published from now on, and mods. Apart of that, what else could happen, if someone releases a game with a part of the source code copied they would be liable for a crime no?
Posted on Reply
#35
ZoneDymo
AusWolfCDPR botched the CP77 launch, true, but how can you connect individual opinion of a game to the fact that the source code of some highly successful games were stolen and potentially sold? Even if it was EA (a company whose business practices are hated by almost everyone), I would still side with them. Theft of one's intellectual property is not the answer to anything.

It's like reading the news of a murder and commenting: "well deserved, the victim was a fat bastard anyway". Disgraceful.
uhh this might be a little dark for you but if the "victim" indeed was a idk, child molesting, rapist, etc etc waste of air then I would indeed say "well deserved" if they ended up being murdered.


Source code was stolen sure, but then imo they stole a bunch of money from the people as well launching fake trailers and broken products and not telling anyone the truth beforehand, so yeah, I dont shed a tear for them sorry.
Posted on Reply
#36
lexluthermiester
ixiWhy?
The current incarnation of the CP2077 engine was developed 2 years ago. However, the project as a whole has been in the works for a little over 8 years. So your statement is sort of true in a round-about way.
DeathtoGnomestime spent developing does not matter, the end product does. Time is by no means any way judge a game.
Also true.
altcapwnConcerning Cyberpunk 2077, their mistake was to give a release date instead of leaving it TBD until ready.
Nope, they did things just right. It was whiny, simpering users that made a mess of it all.
Posted on Reply
#37
TheUn4seen
TartarosAs someone commented before, is there any problem if the code is leaked? They have no mp games so no online aspect to be careful with, and people will have to give up on torrenting those games if the torrents were published from now on, and mods. Apart of that, what else could happen, if someone releases a game with a part of the source code copied they would be liable for a crime no?
No sane company would use stolen code in their products, even China kind of cracks down on such behavior, at least in high profile cases like this. The stolen data wasn't really worth much to anyone other than the owner who would pay for the whole ordeal to just vanish into obscurity and waves of bad PR to end.
That's how these things work. It's no coincidence that the targets are usually big, wealthy companies which fall on rough times and therefore are more inclined to pay for silence. The amount the seller wanted was ridiculous, considering the very limited usefulness of what he was selling, but such auctions usually go in one of two ways - either the owner silently buys back his stuff and gets to keep a brave face, or the seller finishes the auction early saying that "someone bought it" because this community is all about appearances and reputation, and then sells the data in smaller chunks for a more reasonable price. If parts of the data, especially the parts coming from HR and administration such as employee personal information, don't start to surface in smaller "leaks" in a few weeks you can assume the owner silently bought it back.
Posted on Reply
#38
Athlonite
I have exactly Zero F's to give CDPR over this they totally deserved to be Cyber Punked

CDPR>:nutkick: <Me the gamer
Posted on Reply
#39
thesmokingman
They seem to be run by idiots, not taking this seriously.
Posted on Reply
#40
Athlonite
altcapwnChinesePunk 2077; in a dystopic society ravaged by an oppressing government and an ongoing pandemic, our hero falls into criminality as its his only way to survive without any job and revenue.
Starring Mao Zedong as Comrade Johnny
Posted on Reply
#41
AusWolf
ZoneDymouhh this might be a little dark for you but if the "victim" indeed was a idk, child molesting, rapist, etc etc waste of air then I would indeed say "well deserved" if they ended up being murdered.


Source code was stolen sure, but then imo they stole a bunch of money from the people as well launching fake trailers and broken products and not telling anyone the truth beforehand, so yeah, I dont shed a tear for them sorry.
They never stole money from anyone. People (myself included) paid willingly for a product. Sure, the game did not live up to expectations because of the bugs, but CDPR is constantly working on it still. I pre-ordered the game a couple weeks before launch, and haven't even touched it yet. I'm not saying that everybody should wait half a year before playing a new game. All I'm saying is, you got something for your money. Something that's slowly improving as we speak. You can ask for a refund, or just stop crying. The product in no way has any connection with any criminal activity. Like I said, if this had happened with EA, a company that charges a fortune for DLCs and skin packs, it would still be wrong.

If you order pizza, and it ends up being not very tasty, do you go and rob the pizza place?
Posted on Reply
#42
Vya Domus
moobWe know that there was an auction but there's no evidence anyone actually bought it.
Well, there would be a pretty big problem if there was any for whoever bought it, wouldn't it ?
Posted on Reply
#43
Solaris17
Super Dainty Moderator
OctopussAnd is anyone so stupid to believe the hackers' word they wouldn't publish the data IF <something>?
Yes actually. If the group that did the exfiltration is known enough by reputation then compliance is important. It is a business deal after all and trust weirdly does go both ways. If they sold the source for a few million.

Then turned around and tried to hawk it again the public at large would find out and the companies or entities this group is trying to do business with would stop doing business with them.

This happen A LOT in the security industry, but is generally out of scope of this forum so it doesn't surprise me almost 0 members understand this. It happens all the time when massive conglomerates like hospitals or fedex get hit with ransomware.

Its literally within the best interest of the hacking group to be honest.
Posted on Reply
#44
Midland Dog
"cdpr caves into demands" would make a better title
external buyer wanted no further bidding
who tf else would it be lmao
Posted on Reply
#45
Octopuss
Solaris17Yes actually. If the group that did the exfiltration is known enough by reputation then compliance is important. It is a business deal after all and trust weirdly does go both ways. If they sold the source for a few million.

Then turned around and tried to hawk it again the public at large would find out and the companies or entities this group is trying to do business with would stop doing business with them.

This happen A LOT in the security industry, but is generally out of scope of this forum so it doesn't surprise me almost 0 members understand this. It happens all the time when massive conglomerates like hospitals or fedex get hit with ransomware.

Its literally within the best interest of the hacking group to be honest.
Who gives a shit about trust or whatever when possibly just a few individuals get so much money out of it they are set for life?
Posted on Reply
#46
ZoneDymo
AusWolfThey never stole money from anyone. People (myself included) paid willingly for a product. Sure, the game did not live up to expectations because of the bugs, but CDPR is constantly working on it still. I pre-ordered the game a couple weeks before launch, and haven't even touched it yet. I'm not saying that everybody should wait half a year before playing a new game. All I'm saying is, you got something for your money. Something that's slowly improving as we speak. You can ask for a refund, or just stop crying. The product in no way has any connection with any criminal activity. Like I said, if this had happened with EA, a company that charges a fortune for DLCs and skin packs, it would still be wrong.

If you order pizza, and it ends up being not very tasty, do you go and rob the pizza place?
Its hard to quantify but im sure you can atleast throw this under "false advertisement" hence the lawsuits against them, again the old trailer did not represent the game because the game was barely made at all and then they had to scramble to match that bullcrap trailer that tried to and did sell us on the game.
Why were you interested in this game? because of what they claimed what was in it due to that trailer and again, the end product is not even a remote shadow of that trailer, its a complete lie and they never released a new trailer or statement beforehand to warn anyone if the complete lack of anything the game they were buying actually was.

The bugs and glitches is actually not the issues, its the complete lack of content.
Posted on Reply
#47
AusWolf
ZoneDymoIts hard to quantify but im sure you can atleast throw this under "false advertisement" hence the lawsuits against them, again the old trailer did not represent the game because the game was barely made at all and then they had to scramble to match that bullcrap trailer that tried to and did sell us on the game.
Why were you interested in this game? because of what they claimed what was in it due to that trailer and again, the end product is not even a remote shadow of that trailer, its a complete lie and they never released a new trailer or statement beforehand to warn anyone if the complete lack of anything the game they were buying actually was.

The bugs and glitches is actually not the issues, its the complete lack of content.
I don't know... I didn't expect any sort of content based on the trailers (I never do anyway) other than a great story and customizability. What I did expect from CDPR based on their previous games is a lively environment where I can get lost for hours - sort of like The Witcher 3's cities. Based on the gameplay videos I've seen and on what some friends told me, it's all there, just kind of ruined by the bugs.

Anyway, the guys at CDPR are working on ironing out the bugs and adding more content, so I'm going to give it some time. I've got lots of other games to play in the meantime. If some people are too impatient to do the same, I completely understand, but that's what asking for a refund is for. Stealing source code and selling it on the internet is just too extreme regardless of whether CDPR deserved it or not.
Posted on Reply
#48
Bzuco
AusWolfIf you order pizza, and it ends up being not very tasty, do you go and rob the pizza place?
I see this on every forum. People are trying to find example from real life to describe what cdpr management committed against customers. And people always failed. So I will correct your example to make more sense, even it is still not suitable example.
It should be something like this: "If you order pizza, and it ends up being not very tasty, it is not the right size,..., and after a while you will find out that this happend not only to you, but also 8 milion people, and even after few days/weeks there is no sign of correction and immediate refunds is not guaranted, and the owner of the pizzeria had no noble reason to keep the facts secret ...yes, then bad things start.
Again, your pizza story is bad example, but you know where I am pointing.
Posted on Reply
#49
AusWolf
BzucoI see this on every forum. People are trying to find example from real life to describe what cdpr management committed against customers. And people always failed. So I will correct your example to make more sense, even it is still not suitable example.
It should be something like this: "If you order pizza, and it ends up being not very tasty, it is not the right size,..., and after a while you will find out that this happend not only to you, but also 8 milion people, and even after few days/weeks there is no sign of correction and immediate refunds is not guaranted, and the owner of the pizzeria had no noble reason to keep the facts secret ...yes, then bad things start.
Again, your pizza story is bad example, but you know where I am pointing.
The only bad thing about the pizza example is that you don't necessarily get refunds for a pizza, whereas a game definitely gets refunded if you meet the store's criteria. For example, Steam doesn't need a reason to refund anything within 14 days of purchase and 2 hours of play time. They've also got a community review system, which not every pizza place can say about themselves.

I agree with the part that there's nothing noble about the pizza place. It's a business. Equally, there's nothing noble about the hackers. They're just a bunch of criminals hiding behind the false idea of social justice.
Posted on Reply
#50
Bzuco
AusWolfThe only bad thing about the pizza example is that you don't necessarily get refunds for a pizza, whereas a game definitely gets refunded if you meet the store's criteria. For example, Steam doesn't need a reason to refund anything within 14 days of purchase and 2 hours of play time. They've also got a community review system, which not every pizza place can say about themselves.

I agree with the part that there's nothing noble about the pizza place. It's a business. Equally, there's nothing noble about the hackers. They're just a bunch of criminals hiding behind the false idea of social justice.
Correct me if I am wrong, hackers in CP77 incident is just third subject. First subject is cdpr management, the second is customers(especialy PS4 customers).
In your pizza story 1. sub. is pizza owner and 2. sub. is customer who bought pizza and is not satisfied. Why did you merge 2. and 3. subject together in pizza story??? Doesn't make sense and this is where people masivelly failing.

Do you have any evidence, that several CDPR customers are behind hackers attack? ;)
Posted on Reply
Add your own comment
Dec 22nd, 2024 05:01 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts