The hackers who breached CD Projekt Red may be trying to auction the developer’s stolen source code for the Witcher 3 and Cyberpunk 2077 on the digital black market.
An auction for the stolen source code was spotted in a Russian hacking forum on the dark web, according to “VX-Underground,” a security researcher who tracks malware. The starting bid for the data and other internal information is going for $1 million. "They are also selling immediately for $7,000,000," VX-Underground added.
The Russian hacking forum is generally restricted to users who pay $100 to join, limiting the auction’s reach. But to prove the stolen data is real, the same hackers allegedly leaked the source code to Gwent: The Witcher Card Game, which CD Projekt Red released in 2018. A 21GB download for the Gwent code has since been circulating on other forums on the open web.
Motherboard and ZDNet obtained copies of the leaked Gwent code, and say it looks real. The archive also contains a note that claims more data will be released “tomorrow.”
Still, the auction may not fetch much money. Trying to reuse or build a game from CD Projekt’s Red stolen assets would only spark a copyright infringement lawsuit from the developer. Nevertheless, the hackers claim to have also stolen important HR, accounting, and investor-related documents from the gaming company.
CD Projekt Red didn’t immediately respond to a request for comment. However, the company previously said it has no plans to pay a ransom demanded by the hackers. “We will not give in to the demands nor negotiate with the actor, being aware that this may eventually lead to the release of the compromised data,” the developer posted on Monday.
According to security researcher Fobian Wosar, the hackers behind breach likely aren't disgruntled gamers angry about Cyberpunk 2077's troubled release, but real cybercriminals who've launched ransomware attacks before.