Summary
Nintendo of America has confirmed a data breach originating from a cyberattack on TinyPulse, a third-party employee engagement and survey platform owned by WebMD Health Services. A threat actor operating under the name “Shadowbyt3$” exfiltrated approximately 1GB of internal employee data, including names, email addresses, survey responses, bank statements, W-9 forms with employee IDs, and progress reports spanning from 2016 to 2026.
The hackers demanded a $2 million ransom from Nintendo, threatening to leak the stolen data if demands were not met. Nintendo declined to negotiate, after which Shadowbyt3$ shifted their ransom demands to TinyPulse directly and reportedly began leaking alleged employee communications.
Nintendo has emphasized that its own systems were not compromised and that no customer or financial data was accessed. The company stated the exposed information was primarily internal survey content from a small subset of employees, with most data dating back several years.
Source
Hackread — Nintendo America Employee Data Stolen via TinyPulse
Security Boulevard — Nintendo Confirms Limited Employee Data Breach
TechRadar — Nintendo Confirms Data Stolen via Third-Party Cyberattack
Commentary
Another week, another third-party vendor breach. Nintendo’s own systems held up fine — TinyPulse’s didn’t. This pattern is relentless in 2026: Texas Parks & Wildlife lost 3 million records through a vendor, One Medical’s patient data was exposed via a third-party file storage system, and now Nintendo’s employee data walked out the door through a survey platform.
The uncomfortable truth is that most organizations have dozens of SaaS vendors with some level of access to internal data, and very few of them get the same security scrutiny as the primary systems. W-9 forms and bank statements sitting in a survey platform’s infrastructure is exactly the kind of data sprawl that makes third-party risk management so difficult. Nintendo’s refusal to pay the ransom was the right call, but the real lesson is upstream: if a vendor has your employees’ financial documents, it needs to meet the same security bar as your HR systems.