Nintendo Reveals Details Behind Recent Employee Data Security Incident

A data breach in connection with TinyPulse has been reported by Nintendo. However, although there has been exposure of data regarding employees, customer data is unaffected.

---

Officially, Nintendo has acknowledged the breach of its data amid the claim by hackers that they have been able to steal company-related data. In this regard, the breach was reported at the beginning of the week following allegations by cybercriminals that they were in possession of close to 859 MBs of data linked to Nintendo via an employee survey site.

As part of the hackers who committed the breach, SHADOWBYT3$ admitted that they had been able to obtain access to the data from the company following the use of TinyPulse, which is a service meant to conduct surveys and other forms of workplace assessment. According to the cybercriminals, the stolen data contained employee details including their name, identification number, bank statements, survey results, analysis report and other forms of documentation.

To clarify concerns regarding the matter, Nintendo released an official statement regarding the security breach that affected TinyPulse. Nevertheless, the gaming giant stressed out that the extent of the attack was much smaller than what has been reported. Specifically, Nintendo revealed that their systems were not breached in this particular case, and hence no user details were hacked.

The compromised information consists of internal surveys related only to a small number of employees at Nintendo of America. What is worth mentioning, the vast majority of compromised information relates to the period several years ago, thus diminishing the potential risk for the company. Moreover, it appears that employees who work outside North America have not been affected.

According to the company, no evidence exists to support the fact that any consumer data, such as Nintendo accounts or payment details, were targeted during this security breach. As more hackers focus their efforts on attacking technology and gaming companies, this clarification is significant since the client database has become the main target for those attacks.

As part of its response, Nintendo stated that TinyPulse had been utilized as a tool for gathering feedback and conducting surveys among employees. The company admitted to the incident and stressed that it was taking measures in collaboration with the provider to identify the root cause of the attack.

“We are aware of an issue involving TinyPulse, a third-party service used for internal employee surveys at Nintendo of America,” the company said. “Nintendo’s systems have not been compromised, and no personal customer or financial data has been accessed.”

Another important factor highlighted by Nintendo is the relevance of employee feedback to the organization. According to Nintendo, survey platforms help the organization's management gain insights into issues occurring at the place of work and optimize operations. The company once again underlined its commitment to taking care of employee feedback and the protection of organizational information while doing so.

This case is yet another example of the increasing risks of cybersecurity breaches involving third-party service providers. While the company itself could be protected from any such threats, the use of external platforms for conducting business makes it an even better target for cybercriminals looking for ways to obtain access to sensitive information of a company. In recent years, companies operating in different fields have encountered the same problem of targeting of their third-party service providers by malicious actors.

For now, Nintendo claims that there was no impact on consumers following the incident. The company continues working with TinyPulse in order to investigate the event, boost security, and prevent any future cybersecurity breaches.

As the investigation progresses, Nintendo gamers can rest assured that their accounts and personal information are safe, as the focus is now on determining the reason behind the breach and what can be gained from the situation.