Updated at 13:45 GMT, 28/02/2024: Epic Games told TheGamer, "We are investigating, but there is currently zero evidence that these claims are legitimate. Mogilievich has not contacted Epic or provided any proof of the veracity of these allegations. When we saw these allegations, which were a screenshot of a dark web webpage in a Tweet from a third party, we began investigating within minutes and reached out to Mogilevich for proof. Mogilevich has not responded. The closest thing we have seen to a response is this Tweet, where they allegedly ask for $15,000 and 'proof of funds' to hand over the purported data."
Ransomware group Mogilevich claims that it hacked into Fortnite developer Epic Games last night and stole 189GB of data comprised of "emails, passwords, full names, payment information, source code," and more.
As reported by Cyber Daily, a Mogilevich spokesperson says that the data is currently up for sale and that it has given Epic Games the deadline of March 4 to pay. However, it has not asked for a specific amount, posted proof of the hacked data, or said what will happen if Epic Games does not agree.
We have quietly carried out an attack to Epic Games' servers. If you are an employee of the company or someone who would like to buy the data, click on me [referencing a hyperlink on the site that takes you to the group's contact page].
Mogilevich is a newcomer to the ransomware scene. Its first attack was carried out as recently as February 20, only eight days ago. However, in just over a week, it has accumulated four victims including Epic Games. The first was Nissan subsidiary Infiniti USA, followed by Bazaarvoice and Ireland's Department of Foreign Affairs.
"We are Mogilevich," the group said, announcing its formation on February 18. "Our agenda is to severely punish companies and corporations that fail to keep their infrastructure under control and security. Our operators are skilled pen-testers in contrast to other groups like ours in which they lie about their purpose, we agree from the beginning that we are doing it for economic interest."
Similar data was alleged to have been taken from the other three victims. In the case of Infiniti USA, Mogilevich claims that it acquired vehicle identification numbers, first and last names, addresses, ZIP codes, mobile numbers, emails, and passwords. It also claimed that it sold the data in a Telegram chat three days ago on February 25, but use of the app appears to have ceased.
The name 'Mogilevich' is likely taken from Semion Mogilevich, a Ukrainian-born Russian crime boss who was added to the FBI's Ten Most Wanted list in 2009 and removed in 2015.
A similar case took place at the end of last year when ransomware group Rhysida hacked into Spider-Man and Ratchet & Clank developer Insomniac Games, stealing a historic 1.6 terabytes of data, including personal employee information. Similarly, it threatened to leak the data if Sony did not pay, but it had a number in mind, asking for $2 million in Bitcoin. Ultimately, Sony refused, and the data was shared online.
However, Mogilevich has yet to prove that it has stolen the data, so this could be an elaborate scam given how new this group is and considering the fact that it has not asked for a specific amount, unlike Rhysida.
Epic Games Store
Expand Collapse
