BENGALURU: A threat actor calling itself ShadowByte claims to have breached Nintendo and is demanding a $2 million ransom to prevent the release of what it says is 859MB of internal corporate data posted on a well-known cybercrime forum, according to researchers who reviewed sample files.
The samples appear to include human resources-related information such as employee names, corporate email addresses, internal analytics and reporting data, employee surveys and engagement feedback, exported reports, organisational performance metrics, and internal planning documents.
Some of the materials reference TinyPulse, an employee engagement platform used for anonymous workforce feedback. The researchers cautioned that the authenticity and full scope of the incident remain unverified and that it’s unclear whether Nintendo itself or a third-party HR platform was compromised.
Creating reputational risk
The actor claims the records span 2016–2026. Metadata on exported files shows a creation date of January 28, 2026, and researchers said they identified individuals mentioned in survey data who still appear to work at Nintendo, lending some credibility to portions of the sample.
However, the sample alone is insufficient to confirm the breach path or full dataset contents.
If confirmed, the case would reflect a broader trend in which extortion groups exfiltrate sensitive internal data—ranging from source code and financials to HR records—rather than encrypting systems, leveraging the intelligence for phishing and other follow-on attacks and creating reputational risk even when customer data is not involved.
ShadowByte has also claimed a prior theft tied to Starbucks’cloud storage with a $500,000 demand, though researchers said they did not find indicators in the samples linking that data to Starbucks.
