A cyberattack targeting TinyPulse, a third-party employee engagement platform used by Nintendo of America, resulted in the theft of internal survey data and potentially employee personal information. Nintendo confirmed that its own systems were not compromised and that no customer or financial data was accessed. The extortion group Shadowbyt3$ claimed to have exfiltrated approximately 1GB of data, including employee names, emails, bank statements, and W-9 forms, and demanded a ransom. Nintendo is collaborating with the service provider to mitigate the issue. The attack is limited to internal employee data and does not affect Nintendo's gaming operations or customer information.

The breach exposed internal employee survey data and possibly sensitive personal employee information such as names, email addresses, bank statements, and tax forms. No customer or financial data from Nintendo systems was compromised. The incident poses a risk to affected employees' privacy and may lead to extortion or identity theft attempts. Nintendo's operational systems and customer data remain secure and unaffected.

Nintendo is working with the TinyPulse service provider to address and remediate the breach. Since Nintendo's own systems were not compromised and customer data was not accessed, no direct action is required from customers or account holders. Organizations using third-party services should review their vendor security posture and monitor for any further disclosures or ransom demands. Law enforcement advises against paying ransoms as it encourages further attacks and does not guarantee data deletion.