Extortion in the Cloud: How a Targeted Cyberattack Wiped Player Data and Forced ‘Secret Neighbor’ Offline

The multiplayer spin-off of the hit indie horror franchise Hello Neighbor has been thrust into a sudden and unprecedented operational crisis. Secret Neighbor, a popular social deduction game developed by Ukrainian studio Hologryph and published by tinyBuild, has been taken completely offline following a catastrophic security breach.

In an unusual act of digital hostility, an unidentified threat actor bypassed the game’s administrative safeguards, systematically deleted critical player databases, and issued a direct ultimatum: the developers must permanently delist the game from all digital storefronts, or the attacks will continue indefinitely.

The incident highlights a growing and dangerous trend of targeted cyberattacks against mid-tier multiplayer games, exposing the vulnerabilities of modern live-service backends and the extreme leverage that bad actors can exert over developers.

1. Main Facts of the Security Breach

The breach, which occurred in late October, saw an unauthorized individual gain administrative access to the game’s core backend infrastructure. Armed with high-level credentials, the intruder executed a series of destructive actions designed to inflict maximum operational and reputational damage.

The Scope of the Damage

According to statements released by the game’s development and publishing teams, the hacker successfully wiped:

• Player Profiles: Accounts associated with thousands of active players across multiple platforms.
• In-Game Progression: Accumulated experience points (XP), character levels, and matchmaking statistics.
• Virtual Inventories: Unlocked cosmetics, in-game currency, and purchase histories.
• Custom Title Data: Configuration files and backend variables required to run the game’s multiplayer lobbies.

The attack was not limited to a single platform. It was described as a "coordinated attack on our server systems and infrastructure" spanning PC, PlayStation, Xbox, Nintendo Switch, and iOS.

The Delisting Ultimatum

What distinguishes this security breach from routine ransomware attacks or data-harvesting operations is the hacker’s explicit motive. Rather than demanding a financial ransom in exchange for data recovery or a cessation of activities, the attacker demanded the complete and permanent removal of Secret Neighbor from sale on all digital platforms, including Steam, the PlayStation Store, the Xbox Games Store, and the Nintendo eShop.

The hacker warned that any attempt to restore services without complying with the delisting demand would result in immediate, repeated disruptions to the game’s backend systems. Faced with the threat of ongoing infrastructure damage and a compromised database, Hologryph and tinyBuild chose to take the game entirely offline to isolate their systems and assess the damage.

2. Chronology of the Attack and Response

The crisis unfolded rapidly over several days, forcing the developers into an emergency triage mode.

[Late October] ───> Unauthorized access detected; admin credentials compromised.
       │
[System Wipe] ────> Player databases, progression systems, and inventories deleted.
       │
[The Ultimatum] ──> Hacker demands permanent delisting of 'Secret Neighbor'.
       │
[Emergency Pull] ─> Servers taken offline; developers isolate infrastructure.
       │
[Investigation] ──> Hologryph, tinyBuild, and Microsoft PlayFab initiate data recovery.

Detection and Immediate Action

The anomaly was first detected when players reported widespread login failures, missing cosmetic items, and completely reset account levels. Within hours, the engineering team at Hologryph identified that their backend database had been targeted and partially erased.

Upon discovering that the attacker possessed valid administrative credentials and was actively manipulating system files, the developers made the decision to pull the plug. By shutting down the game’s servers, the team successfully prevented the hacker from causing further damage to interconnected systems or accessing other titles in tinyBuild’s portfolio.

The Investigation Phase

Following the shutdown, Hologryph and tinyBuild launched a joint investigation alongside PlayFab—the Microsoft-owned backend platform that provides cloud services, player management tools, and database hosting for Secret Neighbor.

The primary objective of this phase has been twofold: identifying the entry point used by the attacker to secure administrative credentials and determining if any viable database backups exist to restore lost player progress.

3. Supporting Data and Context: The Hello Neighbor Franchise

To understand the impact of this breach, one must look at the commercial footprint of Secret Neighbor and its parent franchise.

The Rise of a Multi-Million Dollar IP

Hello Neighbor began as a stealth horror game developed by Russian studio Dynamic Pixels and published by tinyBuild in 2017. Despite mixed critical reviews, the game became a viral sensation, largely driven by Let’s Play videos on YouTube and Twitch. Its surreal art style, complex lore, and unpredictable AI captured the imagination of younger demographics.

Recognizing the value of the IP, tinyBuild aggressively expanded the franchise:

• 2019: Secret Neighbor was launched as a multiplayer spin-off. The game tasks a group of children with sneaking into the creepy Neighbor’s basement to rescue a friend, with the twist that one of the players is the Neighbor in disguise.
• 2020: tinyBuild acquired Dynamic Pixels’ development team, establishing a new studio called Eerie Guest Studios in Hilversum, Netherlands.
• 2020: tinyBuild invested $3 million into Hologryph, a Lviv-based studio, acquiring a majority stake to secure the long-term development of Secret Neighbor and other multiplayer projects.
• 2022: Hello Neighbor 2 was released, further cementing the franchise’s presence in the market.

Today, the franchise includes books, a graphic novel series, an animated TV show, and merchandise, with a third mainline game currently in active development.

Player Base and Financial Stakes

Secret Neighbor has maintained a dedicated, active community since its 2019 debut. On Steam alone, the game has accumulated over 14,000 "Very Positive" user reviews. In March 2024, the original Hello Neighbor experienced its highest peak concurrent player count on Steam, demonstrating the enduring popularity of the intellectual property.

Because Secret Neighbor is a live-service, multiplayer-only title, its entire business model relies on player engagement, seasonal events, and microtransactions. A prolonged offline status directly halts revenue generation and risks permanently alienating a highly sensitive player base.

4. Official Responses and Mitigation Efforts

In the wake of the attack, the developers and publishers have prioritized transparency, releasing coordinated statements to reassure their community while working behind the scenes to patch the vulnerability.

Statement from Hologryph and tinyBuild

In a detailed community update published on Steam and shared across social media channels, the companies addressed the severity of the breach:

"An individual managed to gain access to our administrative credentials and carried out a coordinated attack on our server systems and infrastructure… They have also stated they intend to continue targeting the game and its backend systems until the game is removed from sale across all platforms."

The statement emphasized that the decision to take the game offline was preventative:

"As this is an ongoing situation, we have decided to temporarily shut down the game until we have addressed the breach and closed any vulnerabilities that may have led to the incident."

Reassurance on Personal Data Security

Crucially, both tinyBuild and Hologryph have confirmed that no sensitive personal data or financial information was compromised during the breach.

Because Secret Neighbor utilizes third-party authentication and payment processors (such as Steamworks, Xbox Live, and PlayStation Network), payment details, real names, and passwords are not stored on the game’s internal backend servers. The damage was strictly confined to virtual game data and player profiles hosted on PlayFab.

The Recovery Roadmap

The developers are currently working closely with PlayFab engineers to audit their security protocols and attempt data restoration.

• Vulnerability Remediation: Revoking all existing administrative credentials, implementing stricter multi-factor authentication (MFA), and auditing API access points.
• Data Reconstruction: Attempting to restore player accounts and progression using historical server backups. However, the developers have warned that complete restoration may not be possible for all accounts, and some rollback of progress may occur.
• Law Enforcement Involvement: tinyBuild has officially reported the cyberattack and the associated extortion attempt to relevant law enforcement agencies, initiating a criminal investigation into the perpetrator.

5. Implications for the Gaming Industry and Cybersecurity

The attack on Secret Neighbor serves as a chilling case study for the wider video game industry, illustrating the unique vulnerabilities of independent and mid-tier studios operating live-service games.

The Rise of "Cyber-Vandalism" and Extortion

Traditionally, cyberattacks in the gaming sector have fallen into three categories:

1. Ransomware: Encrypting studio files and demanding payment (e.g., the Insomniac Games leak).
2. Source Code Theft: Stealing intellectual property to sell or leak (e.g., the CD Projekt Red breach).
3. DDoS Attacks: Flooding game servers to disrupt gameplay for competitive or malicious reasons.

The Secret Neighbor attack introduces a far more destructive motive: pure operational sabotage coupled with a demand for digital erasure. When a threat actor demands the permanent delisting of a commercial product, the goal is not financial gain, but rather the destruction of a community or the disruption of a business entity. This form of "cyber-vandalism" is incredibly difficult to combat, as there is no financial settlement that can resolve the issue.

The Vulnerability of Third-Party Backend Integrations

Modern game development heavily relies on Backend-as-a-Service (BaaS) platforms like Microsoft PlayFab, Epic Online Services, or AWS GameSparks. These platforms democratize multiplayer development, allowing smaller studios to deploy cloud saves, matchmaking, and virtual economies without building proprietary infrastructure from scratch.

However, this reliance creates a centralized point of failure. If a studio’s administrative credentials for these platforms are compromised—whether through phishing, credential stuffing, or social engineering—the attacker gains god-like powers over the game’s universe.

[Compromised Admin Credentials]
              │
              ▼
    [PlayFab BaaS Portal]
       /      |      
      ▼       ▼       ▼
  [Player] [Virtual] [Title]
  [ Saved] [Economy] [ Data ]
  [ Data ] [ Wiped ] [Erased]
  [Wiped ]

To prevent similar incidents, studios must adopt strict security hygiene, including:

• Mandatory Multi-Factor Authentication (MFA): Enforcing hardware-based or authenticator-app MFA for all administrative accounts.
• Principle of Least Privilege (PoLP): Restricting write-and-delete administrative access to only a handful of essential engineers.
• Immutable Database Backups: Maintaining daily, off-site, read-only backups that cannot be deleted or modified even with administrative credentials.

The Road Ahead for Secret Neighbor

For Secret Neighbor, the path forward is fraught with challenges. Even if Hologryph and PlayFab successfully restore player databases, the studio must rebuild trust with a community that has seen its hard-earned progress vanish overnight.

As the game remains listed but unplayable on Steam and other consoles, the industry will be watching closely to see how tinyBuild navigates this unprecedented crisis. This incident serves as a stark reminder that in the era of cloud-based, live-service gaming, a studio’s greatest asset—its player data—is only as secure as its most vulnerable credential.