Warhorse confirms a cyberattack, with the scope still under investigation

Warhorse Studios has confirmed unauthorized access to its systems and company data. The Kingdom Come: Deliverance developer says it is working with cybersecurity specialists to secure its infrastructure and establish the full impact, while coordinating with the relevant authorities. It has not published a complete account of what was accessed.

The studio’s incident statement is therefore a confirmation of a breach, rather than a detailed notification defining every affected person or category of information. That distinction matters to players trying to decide whether the news changes anything about their own accounts.

What the studio has established

Warhorse acknowledges both the intrusion and access to company data. Its stated priorities include protecting employees, partners and the community while investigating the scope. The company says it will communicate verified information and is not providing interviews or further comments while that work continues.

Those are meaningful disclosures, but they leave important boundaries unresolved. The statement does not identify a particular attacker, describe a ransomware demand, enumerate stolen files or establish that player passwords were exposed. None of those conclusions follows automatically from the words “cyberattack” or “company data.”

A studio breach is not automatically a game-account breach

A developer uses systems for production, business operations and communication. The infrastructure through which players purchase a game or sign into a platform can be separate. Without a disclosed technical scope, it would be premature to treat all of those systems as compromised together.

That is also why the announcement does not justify a claim that an installed copy of Kingdom Come has become unsafe. A breach can be serious without every possible consequence having occurred. Clear reporting has to preserve both halves of that sentence: acknowledge the intrusion and avoid inventing its reach.

For now, the most useful action is to consult the studio’s own incident page for any concrete instructions that apply to an account or service you use. Unsolicited messages claiming to offer a mandatory security patch, compensation or account verification deserve particular scrutiny. The existence of a real incident does not authenticate a message invoking it.

What a useful follow-up would clarify

An actionable update would identify affected services, the relevant period and the categories of data involved, then say whether particular users need to do anything. A general reassurance cannot substitute for those details, just as speculation cannot supply them in advance.

Warhorse’s confirmation puts the incident on the record. The next consequential development will be a defined scope: the point at which a studio-wide security announcement can become specific guidance for the people actually affected.