Warhorse Studios hit by cyberattack, putting LOTR RPG and Kingdom Come sequel at risk

Warhorse Studios, the Czech developer behind Kingdom Come: Deliverance, has been hit by a cyberattack, and the studio's two biggest upcoming projects are now in the crosshairs. In a post on X, the studio told followers: "We're sorry to share that Warhorse Studios has been hit by a cyberattack. We're working with cybersecurity specialists to secure our systems and understand the full extent of what happened. Thank you for standing with us."

CEO Martin Frývaldský went further in a statement to Czech media, saying: "This is a serious incident for Warhorse Studios and for everyone affected. Our immediate priority is to secure the systems, determine the full extent of the breach, and take all necessary steps to protect our employees, partners, and our community. We are deploying all necessary capabilities and resources to address this situation." He did not reveal the attack's purpose or its impact, leaving the most consequential questions unanswered: Was data taken? If so, which data? And what, if anything, is now exposed?

The most obvious target is the details on Warhorse's two announced games: a Lord of the Rings RPG and a new Kingdom Come adventure. A successful attack could open up Warhorse to the kind of leaks that have plagued Rockstar in the build-up to GTA 6, as rogues with early builds leak materials left and right, outside the tight confines of studio marketing plans. For a narrative-driven studio, this is not just a security problem. A leaked script, map, or build can deflate reveal moments that were planned months in advance and undercut the commercial momentum of a game's launch cycle.

If the attackers instead targeted player data, Warhorse faces a different and potentially more expensive problem. As an EU-based company, Warhorse is subject to the General Data Protection Regulation, which requires data controllers to notify regulators of certain personal-data breaches, often within 72 hours of becoming aware of them. The company has not said whether player records were accessed, but the regulatory clock, if applicable, is unforgiving. Fines under GDPR can reach 4% of global annual turnover or EUR 20 million, whichever is higher, so the difference between an IP leak and a data breach is material for any investor or parent company watching this story.

The incident also highlights how exposed mid-size studios are in an industry where the value of the asset, unreleased game content, is enormous, but the security infrastructure around it is not always built at the same scale. Big publishers have dedicated threat-hunting teams and red-team exercises. Smaller studios often rely on external specialists, exactly the kind of partners Warhorse says it is now engaging. That is the right first move, but it is a reactive one, and it comes with a cost: the longer the investigation takes, the longer the studio cannot give employees, partners, or the public clear answers.

For decision-makers in gaming and adjacent creative industries, the Warhorse attack is a reminder that cybersecurity is now a core business risk, not an IT side quest. The studio's public statement is appropriately cautious, but it leaves open whether attackers exfiltrated data, whether they made demands, or whether this was an opportunistic intrusion. Boards and CEOs should read that ambiguity as a prompt to rehearse their own incident-response playbooks before a breach occurs, not after. The key questions, who holds the crown-jewel assets, who is authorized to speak, and how quickly can you verify what was stolen, should have answers ready before an attack lands.

The next update from Warhorse will be watched closely by publishers, investors, and players all asking the same question: Is the Middle-earth RPG still safe? For now, the studio's priority is containment, and the industry is left waiting to learn what the attackers got away with. If the attack follows the pattern of other high-profile studio breaches, the deepest damage may not be to servers, but to a carefully orchestrated marketing timeline and the trust between a studio and its community.