Nintendo employee survey data stolen via third-party TinyPulse platform

On 18 June 2026, Nintendo of America confirmed that attackers had stolen internal employee survey data from TinyPulse, a third-party HR engagement and feedback platform (operated by WebMD Health Services) that it used internally. The disclosure followed claims by the extortion-focused group SHADOWBYT3$, which said it had exfiltrated roughly 859 MB of data and demanded a US$2 million ransom.

What happened

SHADOWBYT3$ surfaced its claim around 13 June 2026, asserting that the stolen TinyPulse data included employee names, email addresses, analytics and survey responses, and related internal reports. The group threatened to publish the material unless Nintendo paid. The attackers themselves noted that the incident did not touch Nintendo's gaming business, describing the impact as limited to "a small amount of employees that work for Nintendo and have used TinyPulse."

Nintendo of America confirmed the theft of internal survey data from the third-party service but stressed that its own systems were not compromised and that no personal customer or financial data was accessed. The affected information was limited to internal survey content involving a small subset of employees.

Why it matters

The incident is a reminder that vendor risk is first-party risk: even when a company's core systems hold firm, sensitive employee data entrusted to an outside HR platform can become an extortion lever. For a brand as closely watched as Nintendo, an attacker-driven leak claim alone generates significant attention regardless of the relatively narrow scope, and the episode underscores why organisations must inventory the third parties holding their workforce data and hold them to the same security and incident-response standards as internal systems.