Hackers are holding Riot Games’ code hostage

After being the victim of a social engineering attack last week, hackers are now holding Riot Games’ code hostage.

In mid-January, Riot Games announced that it had been the target of a successful social engineering attack, but that player information had not been compromised. In a follow-up, Riot Games specified that source code for League of Legends, Teamfight Tactics, and an out-of-use anti-cheat system had been stolen. The next week, Riot Games received a ransom email for that code from the attackers.

Riot Games code held hostage after attack

Riot Games is one of the world’s largest developers, providing the world’s most popular game in League of Legends and two other huge titles. This means that it possesses a huge amount of sensitive player data and impactful systems that affect millions of gamers across the world. As a result, Riot Games is a premium target for hostile actors in the space. So when Riot Games announced that it had been targeted by a social engineering attack, it wasn’t a surprise. What was a surprise was that it seemed to be successful and quite impactful.

Today, we received a ransom email. Needless to say, we won’t pay.

While this attack disrupted our build environment and could cause issues in the future, most importantly we remain confident that no player data or player personal information was compromised.

2/7

— Riot Games (@riotgames) January 24, 2023

In a follow-up post on Twitter, Riot Games specified that it the source code for League of Legends and Teamfight Tactics were taken. Riot has said it has no intention of paying the ransom the attackers are asking for. The main concern, at the moment, is that this source code will allow new cheats. It also included source code for experimental features, including the upcoming 2v2v2v2 deathmatch mode on the Nexus Blitz map. Both new cheats and leaks of upcoming features present serious problems, especially in League of Legends.

What does Riot Games’ code being held hostage change?

The key changes that fans can expect to come from these changes are delayed patches and slower content. The strain on Riot’s systems being taken by the attack extends beyond LoL and TFT. This will lead to slower patches in the immediate future for all of Riot’s titles.

Riot has said it is in the process of trying to evaluate exactly what parts of its code have been exposed by the attack. This process involves world-class third parties, according to the developer. At the same time, Riot is coordinating with law enforcement to track down the perpetrators. This is one of the largest data breaches in Riot’s history, though no player data is believed to have been compromised just yet.

Nothing is certain, as Riot Games has yet to fully ascertain exactly how much of its products were affected by the attack. It’s important to note that the attack was social engineering and not directly technological in nature. Social engineering attacks tend to focus on impersonating legitimate users or staff and acquiring information under the false pretense of an imitated identity. Often these sorts of attacks are done through customer or staff service departments, where social interactions can be weaponized in order to infiltrate security systems.