Warhorse Studios confirms serious cyberattack with unauthorized system access

Warhorse Studios, the Czech developer behind Kingdom Come: Deliverance and an unannounced Lord of the Rings RPG, has confirmed it suffered a serious cyberattack that gave unauthorized access to company systems and data.

The studio disclosed the incident in a statement published on its website. It did not detail the scope of the breach, and it said the full extent is still being assessed.

CEO Martin Frývaldský addressed the situation directly in the announcement.

"This is a serious incident for Warhorse Studios and everyone affected," Frývaldský wrote. "Our immediate priority is to secure our systems, establish the full extent of the breach, and take the necessary steps to protect our employees, partners, and community."

He added that the studio is dedicating the resources needed to address the situation and will communicate further information as soon as it responsibly can.

Warhorse is currently working with external cybersecurity experts to contain the attack and determine what data was compromised. In plain terms: the studio knows it was breached, but not yet how much was taken.

Who owns Warhorse and what is at stake?

Warhorse Studios is a wholly-owned subsidiary of Fellowship Entertainment, a spin-off of the Embracer Group. The studio is best known for the Kingdom Come: Deliverance series and is currently developing a Lord of the Rings RPG that has not yet been released.

For a developer in this position, a breach can carry several cascading consequences:

• Payroll data, including social security numbers or their international equivalents, can be exposed and published online.
• Internal files, if accessed, can reveal projects currently in development.
• Unannounced game plans, concept art and source assets can leak publicly.

The Game Freak incident in 2024 demonstrates the realistic worst case. The Pokémon developer suffered an attack that exposed the personal data of 2,600 employees. The same breach led to the public release of development materials, including assets, concept art and plans for unannounced games.

There is currently no indication whether the attack on Warhorse reached a comparable scale, and the studio has not said whether employee data or development material was accessed.

What changes for the studio and its partners?

Until the assessment concludes, Warhorse faces an operational pause on certainty itself: partners and employees cannot yet know whether their data circulated in the breach. The studio's statement prioritizes securing systems and protecting employees, partners and the community, which signals that notification obligations may follow once the investigation establishes what was taken.

For Fellowship Entertainment, the incident lands during a development cycle that includes a high-profile licensed title in the Lord of the Rings RPG, a project where leaked material carries both commercial and licensing sensitivities.

The studio has committed to further communication once it can responsibly provide it. Watch for that follow-up disclosure — it will determine whether this remains a contained security incident or expands into a data exposure event on the scale of the 2024 Game Freak breach.