AuditTeam claims to have leaked data belonging to Joycity

• Ransomware group: AuditTeam
• Country: South Korea
• Sector: Technology
• Announcement date: April 8, 2026

AuditTeam announces data leak involving Joycity

The ransomware group known as AuditTeam has announced the publication of data allegedly belonging to the South Korean video game developer, Joycity. According to the group's announcement on their leak site, the data was made publicly available following the expiration of a remediation window.

Details of the claimed attack

AuditTeam listed the data belonging to Joycity on their dedicated leak site. The group stated that the initial discovery of the breach occurred on March 5, 2026. Following this discovery, the group claims to have obtained a significant portion of the company's source code. The group has indicated that because the period provided for remediation has expired, the acquired data archive has now been made available to the public.

The announcement provided by the group includes links to compressed archive files that allegedly contain the company's source code. Additionally, the group has shared a decryption key alongside these files.

Affected data types

• Source code

About Joycity

Joycity is a South Korean video game developer and publisher that was founded in 1994. The company is best known for its FreeStyle series and various mobile strategy games. Listed on the KOSDAQ, the organization produces games across a variety of platforms intended for global markets.

Impact assessment and industry implications

This incident may pose significant risks to the company's intellectual property rights and its overall operational security. The exposure of source code is a particularly sensitive matter, as it could weaken the security of existing game projects and potentially lead to the discovery of vulnerabilities in future software development cycles. Such leaks can undermine the integrity of a developer's creative work and technical foundations.

Furthermore, the situation is assessed to potentially impact the company's competitive advantage and could facilitate intellectual property theft. From a regulatory perspective, if the leaked data is found to include user information, the company may face legal sanctions under the South Korean Personal Information Protection Act (PIPA).

In the broader context of cybersecurity, ransomware groups often employ double extortion tactics. In these scenarios, attackers do not merely encrypt a victim's data to demand a ransom for decryption; they also steal sensitive information to threaten its public release. This pressure is used to coerce organizations into paying, even if they have robust backup and recovery systems in place. For organizations in the technology and gaming sectors, protecting intellectual property is a primary defensive objective. Common defensive steps for such organizations include implementing strict access controls, employing robust encryption for sensitive files, and maintaining continuous monitoring of their networks to detect unauthorized data exfiltration. While information regarding the specific methods and identity of the AuditTeam group remains limited, the incident highlights the ongoing risks faced by global technology firms.