Photo: Sergei Elagin/Shutterstock.com
Activision has confirmed that it suffered a data breach in early December. Attackers got access to the company’s systems after phishing an employee using SMS. While the company insists that no sensitive employee, player or game data was lost, security researcher group vx-underground seems to think otherwise, claiming that sensitive “work documents as well as scheduled to be released” content was exposed.
Security research group vx-underground has tweeted screenshots showing that the intruders had gained access to the Slack account of the targeted Activision employee on December 2 and tried to truck other employees using this access. The group claims that the attacker phished a “privileged user” on the network and extracted sensitive work documents and content scheduled for release until November 17, 2023. The files were passed on to them by a single individual who wasn’t able to sell the contents of the breach.
In a statement to the BleepingComputer, an Activision spokesperson did confirm the breach but addressed it as an attempt instead. The ‘attempt’ happened on December 4, 2022. After further investigation, the company “determined that no sensitive employee data, game code, or player data was accessed”.
Moreover, Insider Gaming claims to have access to the entire leak and analysis reveals that the cache contains full names, email addresses, phone numbers, salaries, work locations and other employee details. Since the targeted employee worked in the HR department, they had access to sensitive employee information others wouldn’t have.
The leaked game data seems to mostly revolve around the Call of Duty franchise at the moment and includes upcoming content bundles, release dates and DLCs for Call of Duty Modern Warfare II. The breach only seems to have affected content available for marketing and development environments are reportedly not affected. Finally, player and user data was also not affected.
In the News: Linux 6.2 released with support for M1 Macs
