A new cyber extortion threat hits Nintendo of America, with a group known as ShadowBytes claiming to have accessed sensitive information about its employees. The requirement is for a payment of US$2 million so that this data is not publicly disclosed, raising tension around the gaming giant’s digital security.

ShadowBytes detailed that the compromised material covers a wide range of information. These include email listings, employee identities, bank records, W-9 tax forms, and even private conversations occurring on the internal platform. The total volume of data allegedly extracted from TinyPulse’s servers is estimated to be around 859 megabytes.

The hacker group stated that Nintendo refused any type of ransom negotiation. Faced with the denial, ShadowBytes moved its pressure strategy, directing demand directly to TinyPulse, the company providing the platform. In a statement, the criminals warned that if TinyPulse does not give in to the agreement, all data will be made public, including private conversations of Nintendo employees, highlighting the growing risk of attacks that seek to extort third-party service providers when the primary victim resists payment. This “double extortion” tactic aims to exploit weaker links in the digital supply chain.

Nintendo of America Statement Minimizes Impact of the Incident and Mentions Data Age

In response to the allegations, Nintendo of America released a statement seeking to mitigate the seriousness of the incident. The company ensured that its internal infrastructures were not directly invaded and that no financial or personal information of its customers was exposed.

The company’s official statement confirmed the knowledge of an incident linked to TinyPulse, an external service provider that assists in internal surveys with Nintendo of America employees. The note reiterates that Nintendo’s systems remained intact, without compromising personal consumer or financial data. The information involved is restricted to internal questionnaires from a limited segment of employees, with most records dating back to previous years.

The company reinforced its appreciation for the contributions of its employees and the exchange of perspectives. Additionally, it informed that it is in direct dialogue with TinyPulse to resolve the controversy. To date, TinyPulse has not issued public statements regarding the threats received nor regarding the progress of discussions with the criminal group.