October 27, 2026: Warhorse Studios, the Czech developer of Kingdom Come: Deliverance, confirmed a cyberattack in which intruders gained unauthorised access to company systems and company data. The studio has not said what was taken. Canonical record: warhorse-studios-cyberattack2026. Coverage of the studio’s statement: GamesRadar.
This is a thin-sourcing post. The studio has confirmed the attack but has not published a scope, a date or a list of affected systems. What follows separates what the company has said from what remains open, and gives practical steps for players and staff while the investigation continues.
What happened
- October 27, 2026: Warhorse confirmed the attack in a statement and a social media post. The company says it is working with cybersecurity specialists to secure its systems, investigate the incident and assess its full impact.
- Authorities: The studio says it has contacted the authorities to find those responsible.
- Leadership: The CEO, Martin Frývaldský, called it “a serious incident for Warhorse Studios and everyone affected” and named three priorities: securing systems, establishing how far the intrusion reaches, and protecting staff, partners and the community.
- Communication: The studio says it will share verified information when it has it, and will not give interviews or further comment while the investigation is ongoing.
What is not known
Warhorse has not said when the intrusion happened, which systems were affected, or what company data was accessed. It has not said whether employee information, source code or unreleased development material was involved. At the time of coverage, nothing had appeared to be published.
Press coverage notes that the Kingdom Come: Deliverance 2 Steam page remains available. That tells you about the storefront, not about whether any player account or payment record was affected. The studio has not made a statement about player data.
The studio has committed to two things: a verified update once it has one, and a limit on comments while the investigation runs. It has not committed to a date. That matters for players and partners, who will otherwise fill the gap with rumour. Treat any claim about the data, the number of people affected or a ransom demand as unverified until it appears in a statement from the studio itself.
Game communities are a common place for impersonation after a studio breach. Fake accounts can appear on forums, social platforms and chat servers, claiming to be from the studio or its moderators. A genuine studio statement will be published through its own channels, and anyone asking for a login or a payment in a community chat should be ignored.
Verified vs unverified
- Verified (studio statement, as reported): a cyberattack happened; intruders reached company systems and company data; specialists are involved; authorities were contacted; further verified information will follow.
- Not disclosed: dates, systems, the type of data, the number of people affected, and the entry route.
- Not reported: any leak, extortion demand or claim by a group at the time of coverage.
Who is at risk
Players face the usual follow-on risks after a studio breach: fake support messages, fake patches or mods, and offers of free content that ask for logins. Staff and contractors are a likely phishing target, because attackers often reuse the studio’s name in messages to people who have access to systems. Business partners who handle payments or file transfers with the studio face the risk of invoice or payment-change fraud.
What to do
- Do not trust unexpected support messages that ask for passwords, login codes or payment details. Go to the official store or the studio’s website by typing the address yourself.
- Change the password on any account you use with Warhorse or its store, especially if you reuse it elsewhere.
- Turn on two-factor authentication on the platform account you use to buy and play, and on your email.
- Avoid fake patches, mods and giveaways that ask you to install software or enter a login. Download game updates only through the normal storefront.
- Staff and contractors: treat unexpected IT, HR or “urgent” access emails with suspicion, and report them to whoever manages security at the studio.
- Partners: confirm any change to bank details or payment instructions by phone on a number you already had, not one supplied in the message.
- Watch for the verified update the studio has promised, and be cautious of any claim that describes the data before the studio does.
Context
Game studios hold a mix of player accounts, payment records, employee files and unreleased work, so a breach can touch several groups at once. Until the studio publishes its scope, the honest answer to “was my data affected” is that nobody outside the company knows yet.
Sources
- GamesRadar: Kingdom Come: Deliverance 2 studio hit by cyberattack, CEO confirms
- Game Developer: Warhorse Studios hit by an undetailed cybersecurity incident
Related reading
- Capcom’s CAPCOM ID breach: a game-account leak in which phishing followed the exposure of email addresses.