Kraken ransomware group lists www.cdprojekt.com on its leak site

• Ransomware group: Kraken
• Country: Poland
• Sector: Technology
• Announcement date: February 9, 2025

Kraken claims to have breached CD Projekt

The threat actor known as Kraken has published a claim on its leak site involving the organization www.cdprojekt.com. According to the announcement made on February 9, 2025, the group asserts that it has obtained sensitive information belonging to the company. This listing follows a pattern common in modern cyberattacks where threat actors use public leak sites to pressure organizations by threatening to release stolen data.

The event was officially announced on the group's platform on February 9, 2025. The threat actor shared a series of passwords that allegedly belong to various digital assets of the organization. Alongside these credentials, the group provided a magnet link for data retrieval. The announcement, which utilized a cryptic message, implies that the group has gained unauthorized access to the organization's systems.

Details of the claimed data leak

While the specific volume of the data or the total number of files involved has not been disclosed by the group, the content of the announcement points toward specific types of information. The leak specifically involves credentials that are claimed to be used for various services and platforms. The nature of the leaked information suggests a potential impact on the integrity of digital access controls.

The data identified in the claim includes:

• Password data

Such leaks often involve a variety of credentials used to manage different aspects of a company's digital infrastructure. In many ransomware scenarios, attackers employ a tactic known as double extortion, where they not only encrypt an organization's data but also threaten to publish it to increase the pressure to pay a ransom. While the specific ransom demand for this incident has not been provided, the publication of passwords is a hallmark of this strategy.

About CD Projekt

CD Projekt is a prominent video game developer and publisher based in Poland. The company is widely recognized for its critically acclaimed titles, most notably The Witcher series and Cyberpunk 2077. In addition to its development work, the organization is the owner of GOG.com, a well-known digital game distribution platform.

Potential impact and security implications

This incident may pose a significant risk to the security of the organization's digital assets. If the shared passwords are indeed valid, there is a high probability that unauthorized access attempts to the related systems could occur. Such unauthorized access can lead to further compromises within a network, potentially allowing attackers to move laterally through different environments.

Because the organization is based in Poland, this incident may trigger data breach notification obligations under the GDPR (EU General Data Protection Regulation). Furthermore, a leak of this nature can cause significant damage to the organization's reputation and creates a heightened risk of identity theft for users if their credentials are part of the breach. It is important to note that public information regarding the Kraken group remains limited.

For organizations in the technology and gaming sectors, maintaining robust security postures is essential to mitigate such risks. Common defensive steps include implementing multi-factor authentication (MFA) across all services to render stolen passwords less useful, conducting regular audits of access logs to detect unauthorized entry, and ensuring that all digital assets are protected by strong, unique credentials. Continuous monitoring of threat intelligence can also help organizations stay ahead of emerging threats from groups like Kraken.