Wednesday Morning Rant

Data breaches are so common that most of the time, they become background noise. This is for a variety of reasons including the frequency of breaches and the lack of any meaningful liability when they occur, but also because of why breaches happen and how they usually go. Breaches usually take one of two forms: smash-and-grab jobs for information which is then sold on to various nefarious operators or used privately by industrial or national rivals, and extortion jobs where data or systems are held hostage in exchange for money (or crypto, or whatever).

What is unusual is for a data breach to be executed specifically to harm the target for what might be described as illegal "activism." There was such a breach recently and it is directed widely at an industry. The breach was in essence a hostage/ransom job, but the demand is industrial change. The specific targets of this breach were Take-Two Interactive and its subsidiary Rock Star Games. They are known for "Triple-A" games - major, expensive video games from major studios - and especially for the "Grand Theft Auto" game series.

In this breach, an outfit calling itself "Cyberleek" apparently targeted Take-Two and Rock Star and allegedly stole a playable version of the upcoming "Grand Theft Auto VI" game, which has been in development since 2018 and which is scheduled for release in November of this year. The method used for the alleged breach - hacking, insider leaking, etc. - is unknown. After the breach, Cyberleek started publishing various assets it claims are from the game, including maps, scenes, pre-rendered clips and, importantly, actual gameplay footage from an apparently recent pre-release build. Cyberleek continues to escalate with more leaks, more spoilers, its own memecoin and various calls to action.

For its part, the targeted companies have not confirmed the veracity of the leaks or commented publicly about the alleged breach, but they did issue DMCA takedown notices for the footage and have indicated that they are pursuing subpoenas against service providers like Microsoft and Discord in an effort to identify who Cyberleek is (or are) and to try to contain the leaks. Both of those would be unusual moves if the leaked assets were fake. That, combined with reports that the company is scrambling, indicate that what has been leaked is likely accurate.

What makes this breach notable is that the demands are not for anything of monetary value, they are for a change in industrial and marketing behavior. Cyberleek's demands amount to, "stop pre-orders without physical media, eliminate pay-to-unlock functions of a game that are delivered with the core game content but paywalled unless the customer pays more, and ensure playability of games in single-player mode when your servers go dark." The threat is explicit: do these things, or the leaks will continue and will continue to erode the value of the product.

These demands - particularly the final demand, involving offline playability - are not out of left field in the video game industry. Players tend to hate being nickled-and-dimed after shelling out for a game, and the problem of paid-for games going poof if the company fails or just shuts down its servers a few years down the line has led to a growing activist movement as it becomes more common. The main group associated with that activism has condemned the leaks and attempted hostage-taking, but the problem - and displeasure with the state of affairs - is not exactly new. Cyberleek's actions, however, mark an escalation.

What makes this incident interesting is that it is a major example - perhaps the major example - of the use of cyber espionage tactics for non-political and non-financial purposes. These activities are usually about money (extortion), industrial advantage (stealing trade secrets), national advantage (intelligence activity) or political rebellion. It is not unknown for cyber espionage to be used for other purposes, but using it publicly in an attempt to degrade the value of a product in order to force industrial change is atypical.

It is extremely unlikely that Take-Two and Rock Star will satisfy Cyberleek's demands, and I doubt that the value of "Grand Theft Auto VI" will erode enough to matter if this continues. When Cyberleek gets caught or when the game releases (whichever happens first), the press - and likely much of the industry - will move on and forget about this incident.

The important part of this story isn't the specific players or purposes, but the use of these tactics in a modified way for an atypical purpose. Depending on how it goes, it may be a historical marker in the continuing evolution and expansion of the weaponization of data.

posted by Joe Mannix at 11:00 AM

| Access Comments