Nintendo Faces $2 Million Ransom Demand from Cyberattackers
A threat actor is claiming to have stolen internal corporate data from Nintendo and is demanding a $2 million ransom in exchange for not releasing the information publicly. The group, which identifies itself as ShadowByte$, alleges it has obtained approximately 859MB of data spanning nearly a decade of internal records.
The claims were posted on a known cybercrime forum, where the actor stated that the stolen dataset includes sensitive corporate and employee-related information. While Nintendo has not confirmed any breach, cybersecurity researchers who reviewed provided samples say there are indications that portions of the data may be legitimate.
Alleged contents of the data
According to sample files shared by the threat actor and analyzed by researchers, the compromised material appears to include a wide range of internal records, such as:
Employee names and corporate email addresses
Internal analytics and organizational performance metrics
Human resources surveys and employee engagement feedback
Exported internal reports and planning documentation
Workplace questionnaires and sentiment analysis data
Cybersecurity analysts note that the dataset appears heavily focused on human resources and internal operations rather than customer or product-related data.
Evidence of a long-term data set
Researchers reviewing the samples report that some documents appear to date back as far as 2016, supporting the attacker’s claim that the dataset spans nearly ten years. Metadata from certain exported files indicates creation dates as recent as January 28, 2026, suggesting ongoing or recent data collection activity prior to the extortion attempt.
In addition, some individuals referenced in the leaked materials were identified as current Nintendo employees, which has added credibility to at least portions of the sample data.
Possible third-party compromise
Despite the claims, it remains unclear whether Nintendo’s internal systems were directly breached. Cybersecurity researchers suggest the intrusion may have originated through a third-party service rather than Nintendo’s core infrastructure.
The threat actor specifically references TinyPulse, an employee engagement and feedback platform commonly used by organizations to collect workforce sentiment data. If accurate, this points to a potential compromise of a third-party vendor, a growing risk vector in modern corporate cybersecurity incidents.
ShadowByte$ and extortion activity
ShadowByte$ is a relatively new cybercriminal group reportedly active since early 2026. In addition to the Nintendo claims, the group has previously alleged involvement in other extortion attempts targeting corporate cloud infrastructure.
Their approach reflects a broader trend in cybercrime: shifting from traditional ransomware encryption attacks toward data theft and extortion. Instead of locking systems, threat actors increasingly steal sensitive internal information and threaten public release to pressure victims into paying.
Broader cybersecurity implications
If confirmed, the incident underscores the growing risk posed by third-party software providers and SaaS platforms. Even organizations with strong internal security controls may remain vulnerable if external partners are compromised.
Security experts note that leaked internal datasets—particularly HR records and employee feedback—can still be highly valuable to attackers. Such information can be used for targeted phishing campaigns, social engineering, competitive intelligence gathering, and reputational harm.
The case highlights the importance of strengthening third-party risk management, enforcing strict access controls, and adopting a Zero Trust security model to limit the potential impact of future breaches.
Source 🔗:https://cybernews.com/security/nintendo-employee-data-ransom-claim/