Nintendo has confirmed a data breach involving employee information after a third-party survey provider, TinyPulse, suffered a security incident that exposed internal staff records and feedback data.

Key Points

• Nintendo confirmed that its own internal servers remain secure and were not compromised during the incident.
• The breach originated at TinyPulse, a third-party service provider used by Nintendo for conducting employee surveys.
• The extortion group ShadowByt3$ is demanding a $2 million ransom to prevent the release of stolen employee names, emails, and bank records.
• Nintendo stated that the exposed data is limited to a small subset of employees and consists mostly of information from several years ago.
• The company does not intend to pay the ransom and expects the stolen survey data to be published online.

Why it Matters

This incident highlights the ongoing security risks companies face when sharing sensitive internal data with third-party service providers. While customer information remains safe, the breach underscores the importance of vendor risk management in protecting employee privacy and corporate internal communications.