Company Details
epic-games
10,599
830,671
51126
epicgames.com
0
EPI_9930560
In-progress

Epic Games Company CyberSecurity Posture
epicgames.comFounded in 1991, Epic Games is a leading interactive entertainment company and provider of 3D engine technology. Epic operates Fortnite, one of the world’s largest games with over 350 million accounts and 2.5 billion friend connections. Epic also develops Unreal Engine, which powers the world’s leading games and is adopted across industries such as film and television, architecture, automotive, manufacturing, and simulation. Through Unreal Engine, Epic Games Store, and Epic Online Services, Epic provides an end-to-end digital ecosystem for developers and creators to build, distribute, and operate games and other content. Epic has over 40 offices worldwide with headquarters in Cary, North Carolina.
Company Details
epic-games
10,599
830,671
51126
epicgames.com
0
EPI_9930560
In-progress
Between 700 and 749

Epic Games Global Score (TPRM)XXXX

Description: Stormous, a hacker collective, has been leveraging cyberattacks as political acts, targeting high-profile entities such as ministries, regions, and major economic players like Epic Games. Their strategy involves stealing data and then blackmailing the victims with the threat of publication. This tactic not only seeks financial gain but also aims to destabilize targeted organizations, making each attack a significant threat to both financial and reputational stability.
Description: The fined Epic Games, the video game company behind Fortnite, was fined $520 million by the US Federal Trade Commission (FTC) for non-compliance with the Children's Online Privacy Protection Act (COPPA). Epic Games have to pay $275 million for violating COPPA and another $245 million in refunds for tricking users into making unwanted charges and, changing the default privacy settings. The company intentionally stored personal information, such as names and emails, of its Fortnite subscribers, including minors. With this data, the firm monitors their activity within the game. In the case of minors, Epic Games did not have parental consent.
Description: The Epic Games forums were compromised, exposing 808,000 Unreal Engine and Unreal Tournament forum accounts' salted passwords. Email addresses, birth dates, and private messages are among the information taken from Epic Games. Security experts have expressed dissatisfaction with the degree of security put in place to safeguard customers' data. In response, the firm has stated that it would not be forcing account resets because passwords on the Unreal forums were not compromised. Additionally, the Facebook access tokens that were stored in the database for individuals who logged in using their social account were accessible to the attackers.
Description: The hackers infiltrated the systems of Unreal Engine by SQL injection vulnerability which allowed the hacker to get access to the full database. A hacker has stolen thousands of forum accounts associated with Unreal Engine and its maker, Epic Games. The hacker acquired usernames, scrambled passwords, email addresses, IP addresses, birthdates, join dates, their full history of posts and comments including private messages, and other user activity data from both sets of forums. They immediately investigated the incident and took preventive steps.


Epic Games has 12.36% more incidents than the average of same-industry companies with at least one recorded incident.
Epic Games has 28.21% more incidents than the average of all companies with at least one recorded incident.
Epic Games reported 1 incidents this year: 1 cyber attacks, 0 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Epic Games cyber incidents detection timeline including parent company and subsidiaries

Founded in 1991, Epic Games is a leading interactive entertainment company and provider of 3D engine technology. Epic operates Fortnite, one of the world’s largest games with over 350 million accounts and 2.5 billion friend connections. Epic also develops Unreal Engine, which powers the world’s leading games and is adopted across industries such as film and television, architecture, automotive, manufacturing, and simulation. Through Unreal Engine, Epic Games Store, and Epic Online Services, Epic provides an end-to-end digital ecosystem for developers and creators to build, distribute, and operate games and other content. Epic has over 40 offices worldwide with headquarters in Cary, North Carolina.


🎮🎬 We help make video games, films, and fan favourites you’ve probably played, watched, or heard. We work behind the scenes with game developers, publishers, and entertainment companies to bring their ideas to life and keep them running smoothly. From game development and art production to audio se

Ubisoft is a global leader in gaming with teams across the world crafting original and memorable gaming experiences featuring brands such as Assassin’s Creed®, Brawlhalla®, For Honor®, Far Cry®, Tom Clancy’s Ghost Recon®, Just Dance®, Rabbids®, Tom Clancy’s Rainbow Six®, The Crew® and Tom Clancy’s T
.png)
Epic Games' popular battle royale, Fortnite, has returned to the U.S. Google Play Store following a court order. The game maker had recently...
Yahoo Finance's John Hyland tracks Wednesday's top moving stocks and biggest market stories in this Market Minute.
Gaming News: Epic Games faced a widespread outage, impacting access to popular titles like Fortnite, Rocket League, and Fall Guys.
Multiplayer gamers on different platforms have experienced service outages and disruptions simultaneously. The cybersecurity community...
It looks like the DMA is finally making things a bit easier for Apple users trying to install the Epic Games Store on iOS in the EU.
Atos will be the lead contractor in a consortium with Leonardo to provide cyber security services to the European Union, the Paris listed...
Australia's Federal Court has given Epic Games another win in its global fight against the way Apple and Google run their app stores.
Epic Games has settled the case it brought against Samsung over the Korean giant's treatment of third-party app stores on its Galaxy handsets.
Cybersecurity firm Kaspersky detected over 19 million attempts globally to spread malware disguised as popular Gen Z games like GTA, Minecraft, and Call of...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of Epic Games is http://www.epicgames.com/.
According to Rankiteo, Epic Games’s AI-generated cybersecurity score is 710, reflecting their Moderate security posture.
According to Rankiteo, Epic Games currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, Epic Games is not certified under SOC 2 Type 1.
According to Rankiteo, Epic Games does not hold a SOC 2 Type 2 certification.
According to Rankiteo, Epic Games is not listed as GDPR compliant.
According to Rankiteo, Epic Games does not currently maintain PCI DSS compliance.
According to Rankiteo, Epic Games is not compliant with HIPAA regulations.
According to Rankiteo,Epic Games is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Epic Games operates primarily in the Computer Games industry.
Epic Games employs approximately 10,599 people worldwide.
Epic Games presently has no subsidiaries across any sectors.
Epic Games’s official LinkedIn profile has approximately 830,671 followers.
Epic Games is classified under the NAICS code 51126, which corresponds to Software Publishers.
No, Epic Games does not have a profile on Crunchbase.
Yes, Epic Games maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/epic-games.
As of December 21, 2025, Rankiteo reports that Epic Games has experienced 4 cybersecurity incidents.
Epic Games has an estimated 1,994 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Data Leak and Breach.
Total Financial Loss: The total financial loss from these incidents is estimated to be $520 million.
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with no forced account resets..
Title: Unreal Engine Forum Data Breach
Description: Hackers infiltrated the systems of Unreal Engine by exploiting an SQL injection vulnerability, gaining access to the full database and stealing thousands of forum accounts associated with Unreal Engine and its maker, Epic Games.
Type: Data Breach
Attack Vector: SQL Injection
Vulnerability Exploited: SQL Injection Vulnerability
Threat Actor: Hacker
Motivation: Data Theft
Title: Epic Games Fined for COPPA Violations and Unwanted Charges
Description: Epic Games, the video game company behind Fortnite, was fined $520 million by the US Federal Trade Commission (FTC) for non-compliance with the Children's Online Privacy Protection Act (COPPA). The company has to pay $275 million for violating COPPA and another $245 million in refunds for tricking users into making unwanted charges and changing the default privacy settings. The company intentionally stored personal information, such as names and emails, of its Fortnite subscribers, including minors. With this data, the firm monitors their activity within the game. In the case of minors, Epic Games did not have parental consent.
Type: Data Privacy Violation
Threat Actor: Epic Games
Motivation: Financial Gain
Title: Epic Games Forum Breach
Description: The Epic Games forums were compromised, exposing 808,000 Unreal Engine and Unreal Tournament forum accounts' salted passwords. Email addresses, birth dates, and private messages are among the information taken from Epic Games. Security experts have expressed dissatisfaction with the degree of security put in place to safeguard customers' data. In response, the firm has stated that it would not be forcing account resets because passwords on the Unreal forums were not compromised. Additionally, the Facebook access tokens that were stored in the database for individuals who logged in using their social account were accessible to the attackers.
Type: Data Breach
Title: Stormous Cyberattacks
Description: L'ADN de Stormous ne se résume pas à la seule recherche de profit. Depuis le début du conflit ukrainien, le collectif affiche ouvertement son soutien à Moscou, en transformant chaque cyberattaque en acte politique. Cette stratégie de double extorsion, qui se matérialise par le vol de données d'abord et chantage à la publication ensuite, vise autant l'enrichissement que la déstabilisation. Les cibles choisies ne sont en plus jamais anodines. On y retrouve des ministères, des régions, mais aussi géants économiques comme Coca-Cola, Volkswagen ou Epic Games.
Type: Double Extortion
Threat Actor: Stormous
Motivation: Financial GainPolitical Motivations
Common Attack Types: The most common types of attacks the company has faced is Data Leak.
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through SQL Injection Vulnerability.

Data Compromised: Usernames, Scrambled passwords, Email addresses, Ip addresses, Birthdates, Join dates, Post history, Comments, Private messages, Other user activity data
Systems Affected: Forum Systems

Financial Loss: $275 million for COPPA violation$245 million in refunds
Data Compromised: Names, Emails
Legal Liabilities: COPPA Violation

Data Compromised: Email addresses, Birth dates, Private messages, Facebook access tokens
Systems Affected: Unreal Engine and Unreal Tournament forums
Brand Reputation Impact: negative

Average Financial Loss: The average financial loss per incident is $130.00 million.
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Usernames, Scrambled Passwords, Email Addresses, Ip Addresses, Birthdates, Join Dates, Post History, Comments, Private Messages, Other User Activity Data, , Personal Information, , Email Addresses, Birth Dates, Private Messages, Facebook Access Tokens and .

Entity Name: Epic Games
Entity Type: Company
Industry: Gaming
Customers Affected: Thousands

Entity Name: Epic Games
Entity Type: Company
Industry: Video Game

Entity Name: Epic Games
Entity Type: Company
Industry: Gaming
Customers Affected: 808,000

Entity Name: Coca-Cola
Entity Type: Corporation
Industry: Beverage

Entity Name: Volkswagen
Entity Type: Corporation
Industry: Automotive

Entity Name: Epic Games
Entity Type: Corporation
Industry: Gaming

Entity Name: Various Ministries and Regions
Entity Type: Government
Industry: Public Sector

Remediation Measures: No forced account resets

Type of Data Compromised: Usernames, Scrambled passwords, Email addresses, Ip addresses, Birthdates, Join dates, Post history, Comments, Private messages, Other user activity data
Number of Records Exposed: Thousands
Sensitivity of Data: High
Data Encryption: Scrambled Passwords
Personally Identifiable Information: usernamesemail addressesIP addressesbirthdatesjoin dates

Type of Data Compromised: Personal information
Sensitivity of Data: High

Type of Data Compromised: Email addresses, Birth dates, Private messages, Facebook access tokens
Number of Records Exposed: 808,000
Data Encryption: ['salted passwords']
Personally Identifiable Information: email addressesbirth dates

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: No forced account resets.

Investigation Status: Investigated and Preventive Steps Taken

Entry Point: SQL Injection Vulnerability


Root Causes: SQL Injection Vulnerability
Last Ransom Demanded: The amount of the last ransom demanded was True.
Last Attacking Group: The attacking group in the last incident were an Hacker, Epic Games and Stormous.
Highest Financial Loss: The highest financial loss from an incident was ['$275 million for COPPA violation', '$245 million in refunds'].
Most Significant Data Compromised: The most significant data compromised in an incident were usernames, scrambled passwords, email addresses, IP addresses, birthdates, join dates, post history, comments, private messages, other user activity data, , Names, Emails, , email addresses, birth dates, private messages, Facebook access tokens, and .
Most Significant System Affected: The most significant system affected in an incident was Unreal Engine and Unreal Tournament forums.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were private messages, post history, email addresses, usernames, Names, Facebook access tokens, other user activity data, comments, scrambled passwords, birthdates, join dates, birth dates, Emails and IP addresses.
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 808.0K.
Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was True.
Highest Fine Imposed: The highest fine imposed for a regulatory violation was $520 million.
Current Status of Most Recent Investigation: The current status of the most recent investigation is Investigated and Preventive Steps Taken.
Most Recent Entry Point: The most recent entry point used by an initial access broker was an SQL Injection Vulnerability.
.png)
Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating the requesting user. Due to improper privilege handling and a time-of-check time-of-use race condition combined with symbolic link and mount point manipulation, a local authenticated attacker can coerce the service into deleting arbitrary directories with SYSTEM privileges. This can be exploited to delete protected system folders such as C:\\Config.msi and subsequently achieve execution as NT AUTHORITY\\SYSTEM via MSI rollback techniques.
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject cross-site scripting into the 'status' parameter of applied jobs for any user.
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Candidate-level access and above, to send a site-generated email with injected HTML to any user.
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch "Replace search bars" option enabled for TheGem integration.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.