Activision breach exposed game and employee data

3 years ago 1

ARTICLE AD BOX

Activision suffered a data breach in December 2022 through an SMS phishing campaign that allowed attackers to access the company’s internal systems, Bleeping Computer reports.

While the company says the incident hasn’t compromised any game source code, player details, or sensitive employee data, security research group vx-underground says the attacker “exfiltrated sensitive work place documents”.

It added that the threat actor also exfiltrated Activision’s content release schedule until 17 November 2023, and that the video game maker didn’t inform anyone of the incident.

According to Insider Gaming — a video game publication reporting that it analysed the entirety of the leak — the cache contains full names, email addresses, phone numbers, salaries, work locations, and other employee details.

It added that the employee who fell for the phishing SMS worked for Activision’s human resources department and had access to a vast range of sensitive employee information.

.@Activision was breached December 4th, 2022. The Threat Actors successfully phished a privileged user on the network. They exfiltrated sensitive work place documents as well as scheduled to be released content dating to November 17th, 2023.

Activision did not tell anyone. pic.twitter.com/urD64iIlC5

— vx-underground (@vxunderground) February 20, 2023

However, Activision maintains that the attackers didn’t access any sensitive employee information.

“On December 4, 2022, our information security team swiftly addressed an SMS phishing attempt and quickly resolved it,” a company spokesperson told Bleeping Computer.

“Following a thorough investigation, we determined that no sensitive employee data, game code, or player data was accessed.”

Insider Gaming also listed all the release details revealed in the breach, which includes content bundles for Call of Duty: Modern Warfare II.