Insomniac Data Leak Analysis: Was Not Paying Ransom The Right Choice?

The conclusion of last year saw one of the largest data breaches in the history of the gaming scene. Insomniac Games was attacked by the ransomware group Rhysida, which demanded $2 million in Bitcoin as ransom. The consequences have been gargantuan, but did Sony do enough to prevent the leak that followed? Our bite-sized video analysis looks into whether the conglomerate’s decision not to pay was the right course.

Before analyzing the crux of the aftermath, let’s discuss what occurred behind the scenes before the pandora’s box of leaks was opened. Insomniac Games —the dev behind franchises like Rachet and Clank and Marvel’s Spider-Man— was breached by hackers who gave Sony a deadline of seven days for the ransom. The group alleged that over 1.67 terabytes worth of files would be leaked if the publisher failed to comply.

And as we know, the leak did happen and resulted in tons of sensitive data and game content, including unreleased game concepts, early alpha build footage, timelines, and budgets, all spilling over in the gaming forums. However, what makes this data breach stand out from most others is that a lot of private employee info was also leaked. This could lead to impersonation and a variety of other bad outcomes for the devs involved.

Sony’s Crucial Strategy

So, how did Sony respond to the initial demand? The giant conglomerate did not cave in to pay the huge ransom that was solicited from the Rhysida group. Instead, it launched an internal investigation, but the hackers expressed disappointment. The spokesperson for the group called Insomniac Games an “easy target” and wanted the ransom to be paid behind the curtains. But things did not go the way Rhysida desired.

Yes, we knew who we were attacking. We knew that developers making games like this would be an easy target. Sony has launched an investigation, but it would be better in the backyard,” said the spokesperson to Cyber Daily.

The group of bad actors published the breached data on a bidding site to sell it for the highest price. Not many buyers were particularly interested in the content since almost all of it remained untouched. As a result, the cyberpunks decided to leak all 1.67 TB of it to the public.

Was It The Right Choice?

Many gamers have questioned whether not paying the ransom was the wiser choice of the two. After all, it is not like Sony lacked the resources to comply and give a huge sum to the group. The company’s decision not to fork out the money has cost Insomniac Games notable damages. While ignoring the hackers’ demand may seem irrational on paper, there are several nuances to the overall narrative that need to be considered.

Sony had no reason to trust Rhysida’s word when it hogged over a terabyte worth of files from Insomniac Games. The hackers would have likely leaked the files to the public anyway. The worth of data also may not have equaled the demanded amount. While it held crucial info, almost every leak is from games early in their skeletal stages. These titles—like Marvel’s Wolverine— will look and play entirely differently after years of development.

Then again, the private information of current and ex-Insomniac Games employees also came out after the leak. So, their protection and cost were also an important variable while determining the final choice. It is hard to land on a conclusive judgment here, but what are your two cents about the matter?

The Aftermath

All the data concerning Insomniac Games and its employee info, Sony’s first-party portfolio, and PlayStation was circulated among gamers. We have seen a lot of private info and alpha gameplay builds from Insomniac Games’ upcoming projects in multiple franchises, Marvel’s Venom, Spider-Man 3, a canceled online project, Marvel’s Wolverine, and much more. 

The leaks also include various Sony statistics and presentations that discuss the likelihood of a Sony-exclusive fighting game, demand for remastered projects, and the overwhelming superiority of PlayStation 5’s single-player games over multiplayer ones.