Warhorse Studios, the Czech developer behind Kingdom Come: Deliverance and Kingdom Come: Deliverance II, confirmed on October 27, 2026 that it suffered a cyberattack involving unauthorized access to company systems and company data, according to IGN. Two days on, the Warhorse Studios cyberattack has a firm start and a blurry middle. The studio has confirmed the intrusion. It has not said what was taken, who did it, or whether anything has reached the public.
Some coverage has described the episode as a data leak. That label runs ahead of the evidence, and the gap matters for players, staff and partners trying to judge their own exposure. Our earlier rundown of the five open questions around the Warhorse attack framed what we did not know. This follow-up goes a step further and sorts every claim in circulation into confirmed and unconfirmed.
The analysis below covers the statement itself, how outlets framed it, how the disclosure compares with other 2026 breaches, and what each affected group can reasonably do today. Where the record is thin, we say so. Predictions are our own judgment and carry no insider sourcing.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Warhorse Studios Confirmed on October 27
The confirmed record is short. TechPowerUp reported that the studio published an official statement on its own website, and the wording points to unauthorized access reaching both company systems and company data. The studio is the developer of Kingdom Come: Deliverance and its sequel, so the intrusion hits a studio with a large public following.
- Unauthorized access to company systems and company data occurred.
- Warhorse says it is working with cybersecurity experts to secure its systems, investigate the incident and assess its full impact.
- The studio says it is coordinating with relevant authorities.
- Warhorse will not give interviews or additional comments while the investigation continues.
Everything else is open. The studio did not name an attack date, a method or a responsible group. It did not say whether employee records, partner contracts, source code or player-facing databases were touched. That restraint is typical of the first 72 hours of a real incident, and it leaves a vacuum that rumor tends to fill quickly.
Reading the Warhorse Statement Line by Line
The statement is brief, and two sentences carry most of its weight. The first sets the tone. Warhorse Studios wrote: âThis is a serious incident for Warhorse Studios and everyone affected.â The phrase everyone affected is the only hint at scope. It implies more than the company alone, but it does not define who counts as affected.
The second sentence sets priorities. The studio wrote: âOur immediate priority is to secure our systems, establish the full extent of the breach, and take the necessary steps to protect our employees, partners, and community.â Note the order. Containment comes first, scoping second, protection of people third. Employees and partners are named before the community, which suggests the studio is thinking about internal and business data as well as anything player-related.
The word breach also deserves a flag. The studio used it in describing the extent it wants to establish, which is a stronger term than incident alone. GamesIndustry.biz headlined its report around company systems and data being affected, and outlets including Yahoo and Games.gg framed the announcement as the CEO confirming the attack. Neither framing adds facts beyond the studio statement. Both show how quickly a short corporate notice becomes a leadership story.
Confirmed Versus Unconfirmed: The Fact Table
The table below separates what the studio has said from what remains speculation. Use it as a reference when you see a social post claiming more.
| Claim | Status | Basis |
|---|---|---|
| Unauthorized access to company systems and data | Confirmed | Studio statement, Oct. 27, 2026 |
| Warhorse develops Kingdom Come: Deliverance and Kingdom Come: Deliverance II | Confirmed | Studio and multiple outlets |
| Cybersecurity experts engaged | Confirmed | Studio statement |
| Relevant authorities contacted | Confirmed | Studio statement |
| No interviews during investigation | Confirmed | Studio statement |
| Data published or leaked externally | Unconfirmed | Studio has not confirmed any external leak |
| Which data was accessed or exfiltrated | Unconfirmed | No detail disclosed |
| Attack date, perpetrators, method, cost | Unconfirmed | No detail disclosed |
| Kingdom Come: Deliverance II or unreleased projects compromised | Unconfirmed | No detail disclosed |
Five rows are confirmed and four are not. That ratio is the honest summary of the story today. Any headline that treats a row from the second group as settled is getting ahead of the studio.
Why Data Leak Is the Wrong Label So Far
Security teams use three separate terms for three separate events, and the Warhorse data breach coverage has blurred them. Access means an intruder got into a system. Exfiltration means data was copied out. Leak, in common usage, means that data became public. Only the first has been confirmed for Warhorse.
Access is not exfiltration
An attacker can sit inside a network, read files and leave without copying anything. The studio’s phrase about unauthorized access to company data means the attacker reached data. It does not say the attacker took it. Defenders often cannot tell the difference for days, because logs on file servers and cloud storage vary widely in quality.
Exfiltration is not publication
Stolen data is frequently held for extortion before anything appears online. Reports on this case state that the studio has not confirmed any external leak, so a public dump, if one is coming, has not been verified. Readers should treat any download link claiming to hold Warhorse files as unverified and potentially malicious in its own right.
The Unreleased Games Question
The most clicked angle in the coverage is the fate of unreleased work. TweakTown’s headline says the attack puts two unreleased games at risk. Read it as a statement of exposure, not of damage. The studio has not confirmed that Kingdom Come: Deliverance II or any other unreleased project was compromised, and that point remains unconfirmed.
IGN describes Warhorse as the team behind the two Kingdom Come games and an upcoming Lord of the Rings role-playing game. A studio with an unreleased, licensed project in development holds material that matters to outside parties, from design documents to licensor correspondence. That is a reason for partners to ask questions. It is not evidence that any of it left the building.
The practical point for fans is simple. If anything from an unreleased game appears online in the coming weeks, its authenticity will need independent confirmation, and the studio has said it is not taking questions. Leaked builds and screenshots have a long record of being mislabeled, edited or recycled from older material.
How Outlets Framed the Warhorse Studios Cyberattack
Ten outlets in our verified source list covered the announcement. Their headlines reveal how the same short statement can produce different stories. The table groups them by framing.
| Outlet | Headline framing | What it emphasizes |
|---|---|---|
| IGN | Serious cybersecurity incident | The studio’s own severity language |
| TechPowerUp | Confirms cyberattack, company data accessed | Data access as the core fact |
| GamesIndustry.biz | Company systems and data affected | Scope across systems and data |
| Polygon | Studio hit by major cyberattack | Scale, using the word major |
| TweakTown | Two unreleased games at risk | Exposure of future projects |
| Gamereactor | Confirms cyberattack, investigating breach | Investigation in progress |
| Yahoo and Games.gg | CEO confirms or addresses breach | Leadership as the source |
| Mezha | Investigates breach | Ongoing investigation |
The word major in one headline and risk in another are editorial choices, not new facts. Gamereactor’s framing, confirmation plus an active investigation, sits closest to what the studio actually said. Readers comparing sources should check whether a headline’s adjective appears anywhere in the studio’s statement.
Historical Context: 2026 Breaches We Have Tracked
The Warhorse incident arrives in a year crowded with disclosure fights. Our analysis of the Capcom ID breach examined how a company’s response, 196 password resets against an 11.77M breach figure, shaped the debate over what users were told. That case is a useful contrast, because Capcom’s story involved concrete numbers while the Warhorse story, so far, has none.
Outside games, our coverage of Navigate360’s admitted hack involved 8 million crime tips and a seven-month window, a reminder that the gap between intrusion and disclosure can stretch far beyond the days Warhorse is working with. Reports do not connect the Warhorse attack to any earlier video game industry breach, so these comparisons are context rather than evidence of a shared campaign.
Studios have a second reason to feel exposed in 2026. Pre-release material is a prized target, and the industry has been tightening controls around it. Rockstar reportedly watermarked GTA 6 review copies to trace leakers, which shows how seriously large publishers now treat pre-launch exposure even before any attacker is involved.
Competitive Comparison: How Four Incidents Disclosed Their Scale
Among the incidents we have covered this year, Warhorse is the only one with no published figure for the number of people or records involved. The table lines the cases up using the numbers reported in our own earlier articles.
| Incident | Headline figure reported | Detail disclosed |
|---|---|---|
| Capcom ID breach | 11.77M breach, 196 password resets | Numeric scale and a user remedy |
| Navigate360 and P3 Global Intel | 8 million crime tips, 7 months | Volume and duration |
| Bithumb, Daishin, Mirae Asset | 38,490 customers | Customer count |
| Warhorse Studios | None disclosed | Access to systems and data only |
The absence of a number is not evidence of a small incident or a large one. It marks an investigation that is early. Companies that publish an early figure can end up revising it, and Warhorse may be avoiding that cycle by waiting until the forensics hold. The cost of that caution is a longer stretch of uncertainty for everyone waiting on an answer.
Why the No-Interviews Policy Is Standard Practice
Warhorse said it will not conduct interviews or provide additional comments while the investigation continues. Fans may read that as evasive, but it follows a pattern across corporate incident response. Legal counsel, insurers and law enforcement usually ask for a single controlled channel, because off-the-cuff remarks can contradict later findings or tip off the attacker about what defenders know.
The studio also said it is coordinating with relevant authorities. Involving law enforcement tends to tighten communication even further, since investigators may want details withheld to protect evidence. Warhorse has promised further information when it can responsibly share it, which is a commitment to an update but not to a date.
For the audience, the takeaway is to judge the studio on what it does in the next few weeks rather than on the lack of detail now. A follow-up that names the affected groups, even without technical specifics, would signal that the investigation has matured. Silence beyond that point would deserve more scrutiny.
Market Impact: What Partners and Investors Weigh
We have no verified share-price or sales data tied to this incident, and we will not infer any. Reports place Warhorse within the wider Embracer and Plaion corporate context, but they do not say that Embracer or Plaion systems were breached and they do not attribute the attack to any named group. That boundary matters, because parent-company risk is a separate question from studio risk.
What partners and licensors will likely weigh is narrower. Contract terms, shared assets and unreleased-project material all travel between a developer and the companies around it. A confirmed breach of company data triggers questions about which of those items sat on the affected systems. Publishers in similar positions generally review access to shared repositories and rotate credentials before they say anything public.
The commercial calculus for the studio itself has two parts. One is direct cost, which Warhorse has not estimated. Reports give no figure for financial cost. The other is trust, which is harder to price. Two well-known games give the studio a base of goodwill that buys time to be methodical, though not unlimited patience.
What Players Should Do Now
No exposure of player accounts has been confirmed. The studio’s wording about protecting its community is a priority statement, not an admission that community data was taken. Even so, a short checklist costs little and helps against opportunistic scams that follow any breach headline.
- Treat unsolicited emails or messages referencing Warhorse, Kingdom Come or the incident as suspicious, and do not click links in them.
- Use unique passwords on any account tied to the games, including storefront and forum logins, and turn on two-factor authentication where offered.
- Ignore any site offering stolen Warhorse files or leaked builds. Those downloads are a common malware vector.
- Wait for the studio’s own channels before acting on claims from social media.
If you want an independent early-warning system, our walkthrough on setting up Have I Been Pwned breach monitoring takes 13 steps and about 40 minutes. It will alert you if an address linked to your gaming accounts shows up in a later dump, whether or not that dump involves Warhorse.
What Employees, Partners and Modders Should Watch
The studio named employees and partners among those it intends to protect. If staff records were accessed, the realistic risk is targeted phishing that uses real names, roles and project details. Messages that look internal, reference a contract or ask for a quick credential check are the typical pattern after an intrusion at a company of this kind.
Partners and contractors should verify any request that touches payment details or file access through a second channel, such as a known phone number. Outside developers who share repositories or build servers with Warhorse should confirm with their contact whether shared credentials need rotating. Asking costs a short email. Skipping it can cost a lot more.
Modders and community moderators sit in a gray zone. They often hold elevated access on forums or community servers tied to a studio. Review who has admin rights, reset any shared tokens and keep an eye on impersonation of studio staff. For wider context on the genre, see our gaming coverage hub.
Five Predictions for the Warhorse Investigation
These are our judgments, based on how comparable incidents have unfolded. None come from the studio or its partners.
- Warhorse publishes at least one scoped update within the next several weeks, naming which groups were affected even if technical detail stays withheld.
- A third party claims to hold stolen Warhorse material, and the claim stays unverified for some time. Treat the first claim with caution, since early extortion posts often exaggerate.
- The studio states whether employee or partner data was involved before it says anything about player data, given the order of priorities in its own statement.
- No confirmed statement about unreleased projects appears until forensics are complete, so speculation about the Lord of the Rings title will outpace facts.
- Other European studios quietly review access controls and publish short security notes, as peers tend to do after a high-profile intrusion.
Frequently Asked Questions
What happened to Warhorse Studios?
Warhorse Studios confirmed on October 27, 2026 that it suffered a cyberattack involving unauthorized access to company systems and company data.
Has the Kingdom Come: Deliverance developer’s data been leaked?
Not confirmed. Reports state that the studio has not confirmed whether any information was leaked externally. Access to data and public release of data are different events.
Was Kingdom Come: Deliverance II compromised?
The studio has not said so. Whether the sequel or any unreleased project was compromised remains unconfirmed.
Who is behind the Warhorse cyberattack?
Unknown. The studio has not named perpetrators, a technical method, an attack date or a financial cost.
Should I change my passwords?
No player exposure has been confirmed, but unique passwords and two-factor authentication are sound habits at any time, and especially while phishing attempts tend to spike after breach headlines.
Why won’t Warhorse give interviews?
The studio said it will not conduct interviews or give additional comments while the investigation continues. Investigations commonly restrict communication to protect evidence and avoid contradicting later findings.
Where will updates appear?
Warhorse published its statement on its own website, and the studio said it will share further information once it can do so responsibly. Check the studio’s official channels first.
