Game Freak data breach compromised Pokémon game source codes and beta builds

Game Freak, the Japanese video game developer known for co-owning the Pokémon series video game, said it experienced a significant data security incident that compromised its employees’ personal information, but industry sources believe the hack compromised source codes and game designs for unpublished games.

 

Recently, screenshots started surfacing on social networking site X to indicate that Game Freak’s internal network had been breached and several gigabytes of data, including source code and beta builds for unpublished Pokémon HeartGold, SoulSilver and Pokémon Black 2 and White 2 games, were accessed and acquired by a threat actor.

 

 

While Game Freak did not comment on these claims, it announced through a statement published on its site that threat actors had gained access to its employees’ personal information.

 

“Game Freak Inc. announces that in August 2024, unauthorised access to our servers by a third party occurred, resulting in a leak of our employees’ personal information,” the developer said. “We deeply apologise for any inconvenience and concern this may have caused to all concerned parties.”

 

Game Freak added that the compromised data includes names and email addresses of more than 2,600 current and former employees.

 

According to gaming publication Nintendo Everything which covers all topics related to Nintendo, the data security incident at Game Freak compromised source codes for various upcoming games.

 

“Game Freak, the main developer of Pokémon, appears to have been hit with a significant hack. As a result, source code for various games, behind-the-scenes information, and more has started to leak online,” it said.

 

“Thus far we know that source code for Pokemon Heart Gold / Soul Silver and Black 2 / White 2 have surfaced. A few codenames are also popping up, including “Gaia” – which is apparently what Gen 10 is going by internally,” the publication added.

 

Game Freak is yet to share details about the threat actors responsible for the cyber incident or whether it was presented with a ransom demand.