A new Epic Games ransomware claim hit the internet overnight as leaker group Mogilevich claims to have possession of 189 gigabytes worth of internal data from the Fortnite developers. This morning, Epic Games responded to the claims.
The claim was posted on Mogilevich’s darknet website last night, with the team boasting nearly 200GB of farmed “email, passwords, full name, payment information, source code, and many other data.” They’ve listed it for sale, either to the company itself or any other bidder. As of yet, they have not requested a specific price, but the listed deadline for claiming the information is March 4.
There’s currently no evidence that this team actually gathered any of the said data. In fact, Epic Games responded to the claims with a confident rebuttal in a statement to VGC:
We are investigating but there is currently zero evidence that these claims are legitimate. Mogilevich has not contacted Epic or provided any proof of the veracity of these allegations.
When we saw these allegations, which were a screenshot of a darkweb webpage in a Tweet from a third party, we began investigating within minutes and reached out to Mogilevich for proof. Mogilevich has not responded.
The closest thing we have seen to a response is this Tweet, where they allegedly ask for $15k and “proof of funds” to hand over the purported data.
It’s likely that numerous ransomware groups have been inspired by the recent leak of Insomniac Games’ personal data and plans for future titles. Back in December, a group named Rhysida attempted to auction off tons of Insomniac’s data for $2 million USD. After receiving no bids, they posted countless slides, documents, and footage of Insomniac’s internal data. It’s likely this move and its reception motivated other ransomware groups to attempt the same with other companies.
It goes without saying, but this is an awful practice and a serious security concern for the individuals working at this company. Hopefully, Epic Games is correct in their assumption and Mogilevich is simply bluffing in an attempt to earn some quick cash.
We’ll be sure to update our readers as the situation develops.
Sources: CyberDaily, VGC
Related MP1st Reading: