A ransomware group claims they stole almost 200GB of data, but have shown zero proof.
Logo for Epic Games.

The ransomware group known as Mogilevich claims to have pulled 189GB of data from internal servers at Epic Games. The group claims to have obtained a slew of data including, but not limited to, "email, passwords, full name, payment information, source code and many other data." The group says that the "have quietly carried out an attack to Epic Games' servers."

Mogilevich is keen to sell the data and have put up a deadline date of March 4, 2024. The group did not actually provide a specific amount that they are seeking for the data. The group did allegedly tell Lawrence Abrams, the owner of BleepingComputer, that they are seeking $15,000 for the data.

More importantly, the group have provided zero proof to back up their claims. They have shown zero screenshots and shared zero of any of the allegedly stolen data to support their claims. This is unlike the recent hack against Insomniac Games where proof was provided right from the start of the entire ordea. That Insomniac Games hack resulted in the distribution of 1.6TB of stolen data.

Epic Games has issued a brief statement about these hack claims. They told Eurogamer that they have "zero evidence these claims are legitimate."

We are investigating but there is currently zero evidence that these claims are legitimate.

Mogilievich has not contacted Epic or provided any proof of the veracity of these allegations. When we saw these allegations, which were a screenshot of a darkweb webpage in a Tweet [see Lawrence Abrams's link above] from a third party, we began investigating within minutes and reached out to Mogilevich for proof. Mogilevich has not responded. The closest thing we have seen to a response is this Tweet, where they allegedly ask for $15k and 'proof of funds' to hand over the purported data.‚Äč
If this hack is legitimate, user data such as credit card information, addresses, passwords, and other sensitive information should be encrypted. Given the complete lack of proof to back their claims, it is looking like this may be a complete lie from Mogilevich.