Warhorse Studios, the developer behind the Kingdom Come: Deliverance games, confirmed in a statement reported today, October 28, 2026, that it was the target of a cyberattack, and TechPowerUp reported that company data was accessed along with company systems. That is the whole confirmed picture so far. The studio has not said what was taken, who did it, or whether anything has leaked.
The short statement leaves a lot of room for questions. Warhorse says it is working with cybersecurity experts, coordinating with relevant authorities, and putting the necessary resources behind the response. It also says it will not give interviews or extra comments while the investigation runs. Outlets including GamesIndustry.biz, GameDev.net, Euronews.com, Business Insurance and WN Hub all carried the same core facts, and none of them added hard detail beyond the studio’s own words.
This analysis separates what Warhorse has actually confirmed from what remains open, explains why the wording matters, and sets the Warhorse Studios cyberattack beside other breaches we have covered. Readers who followed our breakdown of Capcom’s 196 password resets and an 11.77M breach figure will recognize the pattern: a brief first statement, a long gap, then slow detail.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Warhorse Studios Confirmed About the Cyberattack
The confirmed facts fit in a short list. Warhorse Studios said it was the target of a cyberattack. The attack involved unauthorized access to company systems. It also involved access to company data. The studio is working with cybersecurity experts to secure its systems, investigate the incident and assess its full impact, and it is coordinating with relevant authorities.
According to GamesIndustry.biz, the company framed its immediate priority as securing systems, establishing how far the breach reaches, and protecting employees, partners and the community. Warhorse also said it is dedicating the resources the incident requires. Those three commitments (containment, scoping, protection) are the standard opening moves in any incident response plan, and the statement reads like a template that legal and security teams signed off on together.
What the statement does not contain is just as telling. There is no date for the intrusion, no count of affected people, no named system and no mention of a ransom demand. Every outlet that covered the Warhorse Studios data breach stuck to the same short list, which suggests the studio gave reporters nothing more than the written statement. The company has said it will not conduct interviews or add comments during the investigation, so the next detail will most likely arrive as a second written update rather than a conversation.
Company Systems and Company Data: Why the Pairing Matters
Security teams treat “systems accessed” and “data accessed” as two different findings, and Warhorse used both phrases. The distinction shapes what happens next, so it is worth unpacking before anyone guesses at damage.
Unauthorized access to systems
System access means someone got past a boundary they were not meant to cross. That could be a mail server, a file share, a build machine, a cloud account or an employee laptop. It tells you that an attacker had a foothold, but it does not say how long they stayed or how far they moved. Forensic teams usually spend the first days rebuilding that timeline from logs, and the answer often changes the severity rating several times before it settles.
Access to company data
Data access is a separate claim. Reading a record is not the same as copying it out of the network, and copying it out is not the same as publishing it. Warhorse has confirmed the first step only. Reports in the coverage we reviewed state that the specific data involved is unconfirmed, and so is whether any of it has been published online. Until the studio says otherwise, anyone describing a “leak” is describing something nobody has verified.
The wording “company data” also draws a line that readers should not blur. It points to the studio’s own business information. The statement does not say that player accounts, payment details or customer records were involved, and the sources we checked do not either. Treat any claim about player data as unsupported for now.
Five Details Warhorse Has Not Confirmed
The title of this piece counts five open questions, and each one comes straight from what the coverage leaves unresolved. Here is the status of each, along with why the answer matters to the people affected.
| Open question | Current status | Why it matters |
|---|---|---|
| What specific data was accessed or stolen | Unconfirmed | Decides whether staff, partners or players face personal risk |
| Whether data was published or leaked online | Unconfirmed | A leak turns a contained incident into a public one |
| Whether ransomware was involved | Unconfirmed | Changes recovery, negotiation and legal exposure |
| Who the attackers are | Unconfirmed | Shapes the threat model and what happens to the stolen material |
| Total scope, damage and financial impact | Unconfirmed | Drives insurance claims, disclosure duties and planning |
| Whether systems and data were accessed | Confirmed by Warhorse | The one hard fact in the case |
The pattern in that table is common. Companies confirm what they can prove on day one and decline to estimate the rest. A cautious statement is not proof of a mild incident, and it is not proof of a severe one either. It is proof that the investigation has not finished.
What Warhorse Studios and Its CEO Said
The verified record of direct statements is short, so each line deserves a close read. GamesRadar quoted the company opening with the line “Warhorse Studios confirms that it has been the target of a cyberattack.” It is a plain sentence, with no hedge such as “possible” or “suspected,” and that clarity is a point in the studio’s favor.
On scope, the same GamesRadar report carried the company’s wording that “The attack involved unauthorized access to company systems as well as access to company data.” That sentence is the factual core of the whole story, and every other outlet’s version reduces to it.
On response, Rock Paper Shotgun reported the studio saying “We are working with cybersecurity experts to secure our systems, investigate the incident, and assess its full impact.” Naming outside experts is a signal that the studio is not trying to handle forensics alone, which is the right call for an incident that has just started.
The tone from the top matters too. Martin Frývaldský, CEO of Warhorse Studios, said, “This is a serious incident for Warhorse Studios and everyone affected,” according to Game Developer. Calling it serious from the first hour is unusual, since many companies open with “limited” or “minor” and walk it back later. Frývaldský also said, in the same Game Developer report, “Our immediate priority is to secure our systems, establish the full extent of the breach, and take the necessary steps to protect our employees, partners, and community.”
Two readings fit those lines. The charitable one says the studio is being honest about uncertainty. The cautious one says “everyone affected” implies a group of affected people exists, even though no count has been shared. Both readings are plausible, and neither can be settled with the information released so far.
How Outlets Covered the Warhorse Studios Data Breach
Coverage spread quickly across gaming and business press. Our verified source list shows reports from GameDev.net, KitGuru, IGN’s Nordic site, GamingOnLinux and WN Hub, alongside the outlets named above. The headlines split into two camps. Most repeat the studio’s own phrase about company systems and data. A few lean on the fact that the studio is behind Kingdom Come: Deliverance 2, because that title drives clicks.
Business Insurance picking up the story is a quiet but meaningful signal. That trade publication targets risk managers and insurers, so its interest hints that the incident is being read as a corporate cyber exposure case. It suggests the insurance angle, including who pays for forensics, legal counsel and notification, will follow this story long after the gaming press moves on.
One more observation about the coverage: in the reports we reviewed, nobody has produced an independent technical finding. None cites published indicators of compromise or a leak-site listing, and none names a group. Every report traces back to the studio’s statement. When you read a headline that sounds more specific than that, check whether it is quoting the statement or adding something new.
Why Game Studios Make Attractive Targets
This is analysis rather than reported fact about Warhorse. Game developers hold an unusual mix of assets. They keep source code, art, design documents, unreleased builds, contract terms with publishers and platform holders, and employee records. Each category has a buyer or a use. Source code can be mined for vulnerabilities, unreleased material can be traded or leaked for attention, and contract data can be used for extortion.
Studios also run loose, creative networks. Artists, designers and external contractors move large files between machines, cloud drives and vendors, often under deadline pressure. Security controls that work well for a bank can feel like friction in a studio, and attackers know it. The same mix of valuable content and distributed access makes studios a practical target for criminals who want leverage rather than quick card numbers.
Disclosure behavior is part of the picture. When a studio confirms an intrusion in public within a short window, it removes some of the attacker’s leverage, because the threat of exposure loses force once the incident is known. That does not make the incident smaller. It does change the negotiation dynamic, and it gives staff and partners a chance to act before a leak does the announcing for them.
Unreleased Projects: What the Headlines Imply
TweakTown’s headline says the cyberattack puts two unreleased games at risk. That is the outlet’s framing, and Warhorse itself has not said which projects, if any, were touched. The studio has not confirmed that any unreleased material was accessed, so the safest reading is that unreleased work is a plausible exposure, not a confirmed one.
The distinction matters because pre-release data is the category that hurts studios most when it escapes. A leaked build or a design document can spoil marketing plans, strain publisher relationships and expose negotiating positions. Players seldom see that cost directly, but staff do, and teams often lose months of planned announcements when a leak forces a change of schedule.
For now, treat the unreleased-games angle as a question for Warhorse to answer. If the studio publishes a fuller update, the first useful sentence will be one that says whether project files, builds or business documents were in scope. Until then, speculation about particular titles adds noise and no information.
Reading the Silence: What the Statement Leaves Out
Warhorse’s decision to skip interviews is standard practice during an active investigation, and lawyers usually insist on it. Every extra comment risks contradicting a later finding, handing attackers useful details, or creating legal exposure. The cost is a news vacuum that other voices fill, which is why rumor threads tend to appear within hours of an announcement like this one.
Several details are missing, and each one will matter later. The studio has not said how the attackers got in. It has not said whether the intrusion is over. It has not said whether backups are intact or whether work has stopped. Those omissions are normal this early. Teams that disclose too quickly sometimes have to retract claims, and a retraction costs more trust than a short delay.
Triage thinking helps here. Security teams rank vulnerabilities and incidents by exploitability and impact, a process we explored in our guide to EPSS, CVSS, CISA KEV and SSVC triage. Warhorse is in the stage before any such ranking is possible, because the facts that feed the ranking are still being collected. A useful rule for readers is to wait for three items before drawing conclusions: an entry vector, a data inventory and a timeline.
How This Compares With Other Incidents We Covered
Looking at past disclosures on this site helps show where Warhorse sits on the transparency scale. The figures below come from our own earlier headlines and reporting, and each measures something different, so the table shows what each number actually counts.
| Incident | Headline figure in our coverage | What the figure measures |
|---|---|---|
| Capcom ID breach | 196 password resets, 11.77M breach | Reset activity set against the reported breach size |
| Navigate360 / P3 Global Intel | 8 million crime tips, 7 months | Records exposed and time to admission |
| TiDB Cloud | 28 days | Time on a stolen service account |
| GMO Internet | $50M demand | Ransom figure in the warning |
| UNM Health | 36,000 systems | Attacker claim, not confirmed scope |
| Warhorse Studios | None disclosed | Studio confirmed access to systems and data only |
The contrast is plain. Several other cases came with at least one number to anchor the debate, even if the number was a claim. Warhorse has given none. That absence is not evidence of anything on its own, but it means the public has nothing to measure the incident against. It is also why careful outlets stick to the fixed facts and refuse to guess.
Disclosure speed versus disclosure depth
The Navigate360 case, which we covered in our report on 8 million crime tips and a seven-month gap, shows the opposite failure. There, the long delay was the story. Warhorse went public fast and shallow. A fast, thin statement is easier to defend than a slow one, but it moves the pressure onto the follow-up, which has to arrive before speculation hardens into accepted fact.
Dwell time as the missing number
The TiDB Cloud incident, detailed in our piece on 28 days on a stolen service account, showed why dwell time is the figure to watch. How long an intruder stayed usually predicts how much data they could touch. Warhorse has not offered that figure, and it will be among the first numbers outsiders look for in any follow-up.
Market and Industry Impact
It is too early to price this incident, and no verified source puts a dollar figure on it. The total scope, damage and financial impact are all unconfirmed. What we can map is the set of cost categories a studio faces after a confirmed intrusion, so readers know where bills typically come from.
| Cost category | Typical driver | Status at Warhorse |
|---|---|---|
| Forensics and containment | Outside experts, system rebuilds | Under way, experts engaged |
| Legal and regulatory | Authority coordination, notification duties | Coordinating with authorities |
| Business interruption | Downtime, delayed work | Not disclosed |
| Extortion or ransom exposure | Demand tied to stolen data | Ransomware unconfirmed |
| Reputation and partner trust | Publisher and platform confidence | Early, still forming |
Beyond one studio, the industry effect is mostly about sentiment. Publishers and platform holders review the security posture of their development partners, and each public incident prompts more questionnaires, audits and contract clauses. Smaller studios feel that pressure hardest, because they lack dedicated security staff. If you run or work at a studio of any size, this is a cheap prompt to test your own incident plan.
For players, the practical effect so far is nil. Nothing in the confirmed facts suggests game services, accounts or purchases are at risk. That could change if the studio later reports otherwise, and we will update this analysis if it does.
What Employees, Partners and Players Should Do Now
Because the studio said its priority includes protecting employees, partners and the community, the groups most likely to need guidance are exactly those three. None of the steps below depends on facts Warhorse has not shared. They are sensible hygiene whenever a company you deal with confirms an intrusion.
- Employees: Expect internal guidance first. Change passwords on anything tied to work, enable multi-factor authentication and treat unexpected messages that reference the incident as suspicious.
- Partners and contractors: Review which credentials, shared drives and tokens connect your organization to the studio, and rotate any that you can.
- Players: No player-data exposure has been reported. Beware of phishing emails or fake “account security” pages that use the news as bait.
- Everyone: Rely on official Warhorse channels for updates and ignore leak claims on social media until a credible outlet verifies them.
Anyone who wants to check whether their own email address has appeared in earlier public breaches can follow our walkthrough of Have I Been Pwned breach monitoring setup. It will not tell you about this incident, but it tells you how exposed your accounts already are, which is the context that matters when phishing follows a breach announcement.
Five Predictions for the Warhorse Investigation
These are analyst judgments based on how comparable incidents have unfolded, not reported facts, and any of them could prove wrong.
- A second written update arrives within weeks. The investigation is still running, so expect a follow-up that names the categories of data involved, even if it stays vague on counts.
- The ransomware question gets answered. Either the studio rules it out or an extortion claim surfaces. Silence on the point cannot last if a group wants leverage.
- Attribution lags behind everything else. Naming an attacker takes careful forensic work, and companies rarely do it early. Anyone claiming certainty in the first days is guessing.
- Partners tighten access rules. Publishers and vendors will likely review credentials and shared environments, which means quieter changes behind the scenes than anything players will see.
- The case becomes a reference point. Trade and insurance press will cite it as an example of a fast, restrained disclosure, and its reputation will depend on how well the follow-up lands.
Watch for three signals in the weeks ahead. A new statement from the studio is the strongest. A leak-site listing or claim from a named group would sharply raise the stakes. A regulator or authority notice would confirm that personal data was in play. For wider reading on breach and threat coverage, our cybersecurity section tracks incidents like this as they develop, and our report on GMO Internet’s ransomware warning and $50M demand shows what the other end of the disclosure spectrum looks like.
The Takeaway on the Warhorse Studios Cyberattack
The Warhorse Studios cyberattack is confirmed, serious by the CEO’s own description, and almost entirely undetailed. Company systems and company data were accessed, an investigation is running with outside experts and authorities, and the studio has stepped back from interviews. Everything else on the list, from stolen data to attackers to total damage, remains unconfirmed per the outlets covering it.
The sensible stance for readers is patience. Hold off on claims about leaks or particular projects, rely on the studio’s official channels, and treat the next statement as the real test. A fast first notice earned Warhorse some credibility, and a clear, specific follow-up will decide whether it keeps it.
Frequently Asked Questions
What did Warhorse Studios confirm?
Warhorse Studios confirmed it was the target of a cyberattack that involved unauthorized access to company systems and access to company data. It says it is working with cybersecurity experts and coordinating with relevant authorities.
Was player data stolen in the Warhorse Studios data breach?
No source we reviewed reports player data being involved. The studio’s wording refers to company systems and company data, and it has not said what specific data was accessed or stolen.
Was ransomware used in the attack?
That is unconfirmed. Warhorse has not said whether ransomware was involved, and no ransom demand has been reported by the outlets we checked.
Who is behind the Warhorse Studios cyberattack?
The identity of the attackers is unconfirmed. No credible outlet has named a group, and the studio has not offered attribution.
Has any data been leaked online?
Whether any data was published or leaked online is unconfirmed. Treat unverified social media posts with caution until the studio or a credible outlet confirms something.
Are unreleased games affected?
TweakTown’s headline frames the incident as putting two unreleased games at risk, but Warhorse has not confirmed that any unreleased project was accessed. It is a possible exposure, not a verified one.
Will Warhorse Studios give interviews about the incident?
No. The studio said it will not conduct interviews or provide additional comments while the investigation continues, so updates should come through official statements.
Where can I follow updates on the investigation?
Start with Warhorse Studios’ own channels, then trade outlets such as WN Hub and the gaming press named above. We will update this analysis if the studio releases new details.
