The "No Way" Know-How: Bracing For Ransomware Attacks

In 2020, Polish game developer CD Projekt Red (CDPR) experienced an extreme example of Murphy's Law. Shortly after releasing Cyberpunk 2077, one of the most anticipated video games of the past five years, CDPR suffered a ransomware attack, which led to assets being frozen and exfiltrated.¹ The timing could not have been worse: the studio was dealing with critical and commercial backlash to its big release, and anonymous hackers were threatening to auction off some of its most important intellectual property – including source codes for many of its biggest video game properties.²

Confronted with all of this, CDPR did something unexpected. It refused to pay any ransom. Within a day of becoming aware of the breach, the developer had released a copy of the ransom note and a public message declaring its refusal to pay, daring the hackers to go ahead with their threats to sell the stolen data.³