Spider Theft
As they travel to celebrate Christmas and New Year’s Eve with their families and friends, hundreds of current and former employees of the video-game studio Insomniac are freezing their credit cards and watching for bank alerts that their personal information has appeared on the dark web
What was supposed to be a relaxing holiday vacation for employees of the PlayStation-owned studio, which released
Spider-Man 2 in October and closed last week for winter break, has turned into a catastrophic stretch thanks to a group of
ransomware hackers. On the eve of the holiday season, they released 1.7 terabytes of data that included footage from upcoming games, confidential business plans and a trove of personal employee information ranging from phone numbers and passport scans to individual performance reviews and disciplinary actions.
The chaos started earlier this month, as Insomniac shut down internal services such as email and Slack while its IT staff worked to recover from the data breach, according to employees. The company then held a series of Q&As and offered regular updates to staff as it scrambled to restore access and deal with the fallout.
On Dec. 12, the hacking group Rhysida announced that it had breached Insomniac’s servers and said it was looking to sell the data for $2 million in Bitcoin. A week later, the company’s worst fears came to fruition as the group dumped the data, which has slowly trickled out as members of the public comb through it all on the internet.
Gamers have gawked at early prototypes from the upcoming game
Wolverine and at revelations of unannounced
Spider-Man and
X-Men games. But the most damaging part of the leak for its victims has been the dissemination of their personal information. Insomniac employees are offered access to IDWatchdog, a service that monitors the web for identity theft, but the timing has made the breach particularly difficult.
The unprecedented leak has turned the holiday season into a nightmare not just for current Insomniac employees but also for former ones. Several have reached out to me this week to say that they too learned that their personal information was part of the data dump. Some said they were frustrated to have not yet been contacted by Insomniac or its parent company, Sony Group Corp.
On Wednesday, employee anxiety ratcheted up a notch as a set of slides (first reported by
Kotaku) revealed that Insomniac boss Ted Price was pushing back against pressure from Sony to cut 50 to 75 jobs from the studio. Rumors of layoffs had been circling among Insomniac staff for months, but this made clear that the threat was real — part of a company-wide cost-cutting initiative that is hitting
many of PlayStation’s studios, despite the resounding success of their games and hardware. (The slides also noted that PlayStation plans to shut down one of its subsidiaries, although it was not clear which one.)
Following the revelation staff had to stress about potentially losing both their identities and their jobs. Initially Insomniac called a meeting for Thursday to address the potential layoffs but it was subsequently rescheduled for after the holidays, according to employees.
