Nintendo downplays data breach, rejects $2M ransom

Nintendo of America is addressing reports of a data breach involving a third-party employee feedback platform, after a hacking group claimed to have stolen nearly a gigabyte of internal corporate data and demanded a $2 million ransom. The company has downplayed the incident, stating its own systems were not compromised and that the exposed information is limited and largely historical.

The hacking group, identified as ShadowByt3 (also referred to as ShadowBytes), alleged in posts beginning on June 12 that it had obtained approximately 859 megabytes of data from TinyPulse, a platform Nintendo uses for internal employee surveys and engagement. The group claimed the dataset includes employee names, corporate email addresses, internal surveys, workforce analytics, financial forms, bank statements, and planning documents spanning from 2016 through 2026. They initially gave Nintendo a 48-hour deadline to pay the ransom, later threatening to leak the data publicly. After Nintendo did not pay, the group reportedly shifted its demands to TinyPulse itself, setting a deadline of June 16.

In response, Nintendo of America issued a statement acknowledging an issue involving TinyPulse but...