Ask
29

Rockstar cannot say who CyberLeek is or how they got in

Bloomberg's Jason Schreier reported on 21 August that as of that afternoon Rockstar had not identified who is behind CyberLeek, and had not worked out how the breach happened at all.

Two days into the largest leak in the company's history, both of the questions that matter were blank. Not narrowed, blank. Management is running the response as "all hands on deck" and there was still no confirmed entry point.

That is the part worth sitting with. Take-Two has effectively unlimited money and a legal department that had already started pulling records, and the answer at that point was still nothing.

Worth remembering what came before it. The 2022 breach was an intrusion from outside, and the security programme built afterwards was aimed at keeping the game inside the building. Years of lockdown followed for the people who work there.

No official statement on the source has come from Rockstar, which is normal for them and unhelpful for everyone else. Staff are reported as frustrated and exhausted, which is now the second time in four years.

One caution on all of the above: it is a single report, sourced to a person familiar with the strategy, and it is a snapshot of one afternoon. Investigations are not usually narrated live.

7 answers Share
Report

Answering anonymously, a moderator will review it first.

  • @quiet_carriage · last wk. · 3 replies

    The "how" being blank is the alarming half and everyone is reading the "who".

    Attribution is genuinely hard and can take months. Not knowing the entry vector after two days is a different thing. That is what you find first, because it is in your own logs, on your own hardware, under your own control. If it is still open you are usually looking at something that did not generate the logs you expected.

    26
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
    • @two_left_thumbs · 2w ago · 2 replies

      That framing is better than mine and I am going to steal it. Own logs versus somebody else's records is the actual split.

      17
      Share
      Reply

      Answering anonymously, a moderator will review it first.

      Report
      • @quiet_carriage · 2w ago

        To be fair to them, a large studio's build infrastructure is not one system with one log. Working out which of forty things to even look at can honestly take a while.

        11
        Share
        Reply

        Answering anonymously, a moderator will review it first.

        Report
  • @mostly_lurking · 2w ago · 2 replies

    Counter view. A company two days into a live investigation with lawyers already filing does not tell a reporter what it knows, and "we have not identified them" is exactly what you say when you have a shortlist you cannot act on yet.

    I am not saying they know. I am saying this particular report cannot distinguish between not knowing and not saying.

    21
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
    • @kettle_on_again · 2w ago

      Fair, though the source is described as somebody familiar with the strategy rather than a spokesperson. That is usually a leak of the internal mood, not a prepared line.

      13
      Share
      Reply

      Answering anonymously, a moderator will review it first.

      Report
  • @dial_up_era · 2w ago

    The 2022 comparison gets used loosely so it is worth being precise. That one got into internal chat and pulled work in progress video. What has come out this week behaves like somebody playing the game.

    Those are not the same category of problem and they do not have the same fix, which is why "they already fixed this in 2022" does not follow.

    14
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report
  • @harbourlight · 2w ago

    Four years apart and the same people get to live through it twice. That is the bit I keep coming back to.

    15
    Share
    Reply

    Answering anonymously, a moderator will review it first.

    Report