Nintendo Confirms Limited Data Breach via Third-Party HR Service Nintendo of America has acknowledged a data breach involving TinyPulse, a third-party HR platform used for internal employee surveys. The incident, first claimed by hacking group ShadowByt3$ on June 13, allegedly exposed 859MB of sensitive employee data, including full names, bank statements, employee IDs, analytics reports, and workplace feedback. In an official statement, Nintendo confirmed that its own systems were not compromised, and no customer or financial data was accessed. The affected information was limited to internal survey content from a small subset of employees, with most data dating back several years. The company is working with TinyPulse to address the issue. ShadowByt3$ initially demanded a response from Nintendo by June 15, a common tactic in ransomware attacks targeting third-party vendors. While the breach’s scale is smaller than previous incidents like the 2024 Pokémon Company "teraleak," the exposure of sensitive HR data raises significant concerns if verified. Nintendo has not disclosed further details on the breach’s scope or potential impact on affected employees.

Nintendo of America Confirms Data Breach via Third-Party Survey Provider TINYpulse Nintendo of America has acknowledged a data security incident involving TINYpulse, a third-party anonymous employee survey service owned by WebMD Health Services. The breach, attributed to the ShadowByt3$ threat group, exposed internal survey data linked to a small subset of Nintendo employees, with most of the compromised information dating back several years. According to Nintendo, its own systems remain uncompromised, and no customer or financial data was accessed. The company is collaborating with TINYpulse to address the issue. ShadowByt3$ claimed responsibility for the attack, alleging the theft of nearly 1GB of data, including employee personal details such as names, email addresses, bank statements, W-9 forms, progress reports, and survey analytics. The group initially demanded a $2 million ransom, giving Nintendo 48 hours to negotiate with an additional day offered if contacted. The threat actors later posted alleged leaked data, including employee conversations, suggesting Nintendo did not engage in negotiations. Active since October 2023, ShadowByt3$ operates as an extortion-as-a-service group, leaking stolen data from non-paying victims. While it remains unclear whether ransomware was used, the group’s tactics mirror those of traditional ransomware operations, though payment does not guarantee data deletion or future security. The incident highlights risks associated with third-party service providers in corporate data security.

Nintendo of America Confirms Third-Party Breach via TinyPulse, Exposing Employee Data A hacking group known as Shadowbyt3$ claimed responsibility for breaching Nintendo of America, alleging the theft of nearly 1GB of employee data from TinyPulse, a third-party survey platform. The group demanded a $2 million ransom and threatened to leak the files within 48 hours if negotiations failed. The stolen data reportedly included names, email addresses, bank statements, W-9 forms, employee IDs, progress plans, and survey analytics spanning 2016 to 2026. Shadowbyt3$ later clarified that the breach targeted non-gaming employees who used TinyPulse, an employee engagement tool known for its frequent workplace feedback surveys. Nintendo of America confirmed the incident in a statement to BleepingComputer, emphasizing that no customer or financial data was compromised and that its own systems remained secure. The company acknowledged that the breach involved "a small subset of employees" and that "most of the data dates back several years." Nintendo is now working with TinyPulse to address the issue. Following the initial claim, Shadowbyt3$ released a dataset allegedly containing employee direct messages, though the authenticity of the leaked content remains unverified. The move suggests either failed negotiations or an attempt to pressure Nintendo further. No cybersecurity analysts have confirmed the validity of the exposed information.