Warhorse Studios has confirmed a cyberattack. Its statement says the attack involved “unauthorized access to company systems as well as access to company data.” Warhorse is the studio behind Kingdom Come: Deliverance 2, and it is also building an open-world Lord of the Rings RPG alongside another Kingdom Come game. The studio is working with outside security experts and coordinating with authorities. CEO Martin Frývaldský called it “a serious incident for Warhorse Studios and everyone affected.”
That is roughly all we know. No leak has been confirmed. The studio isn’t giving interviews, and it says it won’t add anything until it has verified information.
I think that’s fine. Better than fine.
Early and vague beats late and tidy
The easy criticism is that the statement says almost nothing. We don’t know what data was touched, whose it was, or how the attackers got in. Frývaldský’s line about protecting “employees, partners, and community” covers everyone without committing to anything.
The alternative is worse. Companies that wait until they have the full picture usually mean weeks of silence while staff and customers stay exposed. Rock Paper Shotgun pointed to Capcom, which disclosed its Capcom ID breach later in the process and ended up announcing over 11 million affected accounts, along with phishing warnings. Warhorse appears to have gone public at an earlier stage. If your personal details sit on a studio server, you want to know the door was kicked in now, not after the forensics report is polished.
So I’ll give Warhorse credit for the timing, and I’ll hold them to the follow-up. A quick first statement only counts as good practice if a specific second one actually arrives.
Why game studios are juicy targets
Any company hates intruders. Game studios carry an extra risk, because unreleased work leaks and can’t be pulled back. RPS ran through the recent list: CD Projekt Red, Insomniac and Rockstar have all been hit. In the CD Projekt case, staff data stolen in the hack may have ended up circulating online. In Insomniac’s case, hackers shared employee personal information along with company material.
That precedent is the part that worries me most. Fans will look first at whether early Lord of the Rings footage or Kingdom Come design documents might surface. The people who usually pay the biggest price are the developers, whose passports, contracts and home addresses end up in a dump file. Warhorse’s statement mentions protecting employees first in its list, which is the right order, even if it reads like boilerplate.
The Lord of the Rings project raises the stakes. It’s a licensed property with a rights holder attached, so any leak of that material becomes a partner problem as well as a studio embarrassment. That is presumably part of why the word “partners” appears in the CEO’s statement.
The AI angle, kept in proportion
RPS raised a recent uptick in AI-enabled hacking and said plainly that there’s no known link to this attack. I’d leave it there. Nothing in Warhorse’s statement points to how the intruders got in. Pinning it on AI tools before the investigation reports would be guesswork. AI-enabled attacks are worth tracking, but this incident shouldn’t be filed under that heading without evidence.
What matters now is the next statement. Warhorse has promised more “as soon as we responsibly can.” The open question is whether that update will say exactly whose data was accessed, or whether it will be another paragraph that covers everyone and names no one.