Nintendo Confirms TinyPulse Data Stolen in Shadowbyt3$ Extortion Attack
Published
Key Takeaways
- Breach Confirmed: Nintendo of America confirmed threat actors stole survey data from TinyPulse, a third-party platform owned by WebMD Health Services.
- Systems Safe: Nintendo's own systems were not compromised, and no customer or financial data was accessed.
- Ransom Demand: Shadowbyt3$ claims nearly 1 GB of data stolen and demands a $2 million ransom within 48 hours.
Nintendo of America has confirmed that threat actors stole survey data from TinyPulse, a third-party employee engagement platform used internally for anonymous staff surveys. The platform is owned by WebMD Health Services.
The disclosure follows claims from the extortion-as-a-service group Shadowbyt3$, which says it exfiltrated sensitive data tied to employees of Nintendo of America, a subsidiary of the Japanese gaming company.
Nintendo Confirms the TinyPulse Incident
Nintendo stated that its systems were not compromised and that no personal customer or financial data was accessed. "The data involved is limited to internal survey content comprising a small subset of our employees, and most of the information dates back several years," the company said in public statements.
Nintendo added that it is working with the service provider to address the issue. WebMD Health Services, the owner of the TinyPulse platform, has not yet commented on the matter.
While Nintendo states the data breach only exposed survey information, Shadowbyt3$ claims the stolen data includes employee personal details.
$2 Million Demand
Shadowbyt3 reportedly stole approximately 859 MB of data from TINYpulse systems, including full names, email addresses, analytics and survey data, bank statements, and W-9 forms with employee IDs, progress plans, and reports spanning 2016 to 2026. The hackers demanded a $2 million ransom and set a 48-hour deadline for negotiations.
This threat actor alias is relatively new, describing itself as an "extortion-as-a-service group" operating since October 2025. The same model is used by the cybercriminal alliance Scattered LAPSUS$ Hunters, which emerged in November 2025.
In other recent news, malicious Steam Workshop wallpapers are hijacking accounts to distribute DarkKomet, Lumma, Vidar, and RenEngine, and Argamal RAT is targeting hentai gamers via trojanized games, Kaspersky reported earlier this month.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular