Epic Games allegedly had 189GB of confidential data stolen in latest ransomware attack

Epic Games seems to be the latest games studio targeted by hackers, with a ransomware group called Mogilevich claiming to have stolen a copious amount of confidential data.

According to Cyber Daily, Mogilevich made the claim the night of Feb. 27 on its own darknet leak site, saying it “quietly carried out an attack” on the Fortnite maker’s servers. Approximately 189GB worth of data is said to have been stolen, including “email, passwords, full name, payment information, source code and many other data.”

Unsurprisingly, Mogilevich is offering to sell the stolen data, be it back to Epic Games or anyone else, with the deadline being Monday, March 4. But they haven’t demanded a specific figure and, curiously, haven’t posted any evidence that proves they’re in possession of the stolen data. It’s entirely possible this is just a bluff, though any threats like this should still be taken seriously. No doubt Epic Games is triple-checking to see if it was hacked, as Mogilevich claims, doing anything else. At the time of writing, Epic has yet to issue an official statement on the matter.

Mogilevich is allegedly a fairly recent ransomware group, though it does have a track record of committing cyberattacks. Its earliest known target was Nissan subsidiary Infiniti USA, which was hacked by Mogilevich on Feb. 20, with Epic Games being the group’s fourth victim.

Cyberattacks against video game companies like this are sadly not as rare as you’d think. In fact, there have been several especially dire ones in recent years. Toward the end of 2023, Insomniac Games was hacked, resulting in confidential materials related to Spider-Man 2 and its upcoming Wolverine game being leaked online. Before that, in 2022, the same thing happened to Rockstar Games and Grand Theft Auto 6, though in that instance, the hacker responsible was found and arrested. He was deemed unfit to stand trial and was sentenced to “an indefinite hospital order” in December 2023.

Update Feb. 28 8:30am CT: Epic Games has since commented on the situation, saying there is so far “zero evidence” of any cyberattack or company data being stolen. In a statement to Insider Gaming, Epic added it has not been contacted by Mogilevich nor has the group provided its own proof of hacking the company’s servers: “The closest thing we have seen to a response is this Tweet, where they allegedly ask for $15K and “proof of funds” to hand over the purported data.”