Warhorse Studios confirms cyberattack, scope of data exposure unclear

Warhorse Studios has confirmed a cyberattack on its systems and data, with CEO Martin Frývaldský issuing a statement, according to reports dated 27 October 2026. The company says it is working to determine the full extent of the impact, secure its systems, and protect employees, partners, and its community. No access window, record count, or confirmed exfiltration has been stated.

Two categories of data are named as impacted domains in the supplied reports: company systems and company data, including internal files and unreleased projects. A separate report notes possible employee or personal data exposure. Neither thread is confirmed as taken, and the investigation is described as ongoing with no resolution timeline.

What the confirmation does and does not establish

The reports establish that an intrusion is acknowledged and that experts and authorities are involved. They do not establish how access was obtained — whether through a compromised credential, a vulnerable service, or a third party. Without a reported mechanism, claims about what would have prevented the incident are inference, not evidence.

"Potential employee data exposure" and "internal files and unreleased projects" are distinct risks with distinct consequences. Employee records carry notification and fraud concerns; unreleased materials carry commercial and competitive ones. The reports label both as possible, not confirmed. Persistence, exfiltration versus exposure, and the access window remain unknown rather than zero.

• 27 Oct, 11:12 UTC: Report describes a cyberattack at Warhorse Studios; investigation ongoing, no resolution timeline.
• 27 Oct, 11:55 UTC: Frývaldský issues a statement; investigation described as ongoing with updates expected.
• 27 Oct, 12:14 UTC: A further report describes confirmed targeting of systems and data, noting possible employee or personal data exposure.
• 27 Oct, 16:53 UTC: Report describes a "serious" attack; company says it is working to determine full impact and protect employees, partners, and community.

Unannounced projects referenced in the reporting include a Middle-earth RPG and a new Kingdom Come adventure, with projected windows given as April 2027 and March 2028 respectively. Those are forecasts, not facts about the attack. If unreleased materials are confirmed as taken, that is a different problem from employee-data exposure.

Two details in earlier drafts do not belong in this intrusion story. Daniel Vávra's reported February departure from the Kingdom Come: Deliverance director role, and reported criticism over generative AI use, appear in the supplied material but nothing in the current evidence links either to the attack. Sequencing them alongside it invites a causal story the evidence does not carry. Advertising and affiliate partners named in unrelated reporting should likewise be kept separate.

Response posture and the unresolved question

The described posture — expert engagement, authority notification, and a communications clampdown — is conventional. It is also untestable from outside until independent detail arrives. A statement that systems are being secured does not establish that access has ended or that any data left the network.

The reports disagree on scope wording. Two describe confirmed targeting of systems and data; one attaches "possible" to employee or personal data exposure; another lists impacted domains as systems, security, and internal files. Those differences are reporting variation, not admission of loss. Record counts, affected populations, and access duration remain unknown.

A separate framing in the supplied material — describing a wider "Black October" wave of AI-related disruption with Capcom and PlayAsia said to be similarly affected — is a contextual claim, not established shared causation. Capcom appears in the event records as a company with a similar prior attack; PlayAsia does not. That weakens, rather than supports, the broader campaign framing. Shared industry and timing do not establish one actor, one technique, or one campaign.

The unresolved outcome is scope: access window and record counts remain unknown rather than zero. The observable milestone is the next Warhorse statement via its stated channels, or a verified account from the authorities it says it contacted.

Explore more coverage on BeansSearch this story across publishers→