THQ Nordic allegedly targeted by direwolf ransomware group

• Ransomware group: direwolf
• Country: Sweden
• Sector: Technology
• Announcement date: August 30, 2026

The Swedish video game publisher THQ Nordic has reportedly been listed on a leak site operated by the threat actor group known as direwolf. According to the announcement made on August 30, 2026, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization, totaling approximately 335 GB.

The alleged attack by direwolf

The threat actor group direwolf has posted a listing on its dedicated leak platform claiming responsibility for the breach of THQ Nordic. The group asserts that the attack occurred on August 30, 2026. In their announcement, the actors claim to have obtained sensitive information, specifically targeting the organization's intellectual property and internal administrative records.

The claims made by the group suggest a broad scope of theft. The threat actor alleges that the stolen data includes source codes and corporate financial documents that detail the organization's internal structure. Furthermore, the announcement indicates that the breach involves technical documentation and various corporate records that purportedly belong to the company's various development studios and its various subsidiaries.

Data allegedly involved in the breach

The information allegedly stolen by the direwolf group is described as being highly sensitive to the company's operations and development pipeline. The leaked content is said to include technical files related to ongoing game development projects, as well as diagrams outlining the corporate structure of the organization. The group claims that the exfiltrated data contains:

• Source codes
• Corporate financial documents
• Project technical documentation

While the group has provided a specific volume for the data, they have not provided a specific file count. Additionally, no ransom demand has been specified in the public announcement.

About THQ Nordic

THQ Nordic is a video game publisher and developer based in Sweden. As a prominent member of the Embracer Group, the company manages a diverse portfolio of intellectual properties and is responsible for the global distribution of various games.

Potential impact and security implications

The exfiltration of the alleged data presents several significant risks to the organization. The loss of source codes and technical documentation related to game development projects could have long-term negative impacts on the company's intellectual property rights. Such exposure poses a continuous security risk to the software and various game projects currently being developed by the company.

Furthermore, the disclosure of corporate structure and financial information creates a dangerous environment for the organization. Such data can serve as a foundation for secondary attacks or highly targeted phishing attempts against employees and stakeholders. Because the organization is located in Austria, this breach may potentially trigger legal and administrative sanctions under the EU General Data Protection Regulation (GDPR).

In the broader context of cybersecurity, this incident highlights the risks associated with double extortion tactics. In such scenarios, threat actors not only encrypt an organization's systems but also steal sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly. For organizations in the technology and gaming sectors, protecting source code is critical, as its exposure can compromise the integrity of their products. Defensive measures typically include robust access controls, encryption of sensitive files, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Information regarding the specific capabilities and history of the direwolf group remains limited in the public domain.