Game Freak, the Tokyo-based video game developer and co-owner of the globally popular Pokémon franchise, confirmed last week that it was the target of a cyberattack earlier this year, leading to a significant data leak. This confirmation follows reports that hackers breached the company’s systems, allegedly stealing a large volume of sensitive data.
With over 480 million Pokémon games sold worldwide as of 2024, making it the third best-selling video game franchise behind Mario and Tetris, this breach has raised concerns within its vast fanbase. According to Game Freak, the attack occurred in August when an unidentified threat actor gained unauthorized access to its servers, compromising the personal data of more than 2,600 current and former employees, including names and email addresses.
Although there have been reports suggesting that unreleased Pokémon projects and development materials were among the stolen data, Game Freak has not confirmed or commented on the potential leakage of upcoming game information. The company did not respond to requests for further comments before the publication of these reports.
Over the weekend, Nintendo Everything reported that some of the leaked data included source code for various Pokémon games, unseen artwork, design documents, and other internal development materials, which had started to circulate online. Some of the alleged data was also posted by the CentroLeaks account on X, which is known for sharing Pokémon leaks, as well as on the PokeLeaks subreddit. However, the authenticity of the leaked material remains uncertain at this time.
In response to the breach, Game Freak has stated that they have “rebuilt and re-inspected the server” and will continue to bolster their security infrastructure to prevent further incidents. “We deeply apologize for the great inconvenience and concern caused to all those involved,” the company said, adding that they have contacted the affected employees directly.
This cyberattack on Game Freak follows a broader trend of targeted attacks on Japanese entertainment companies. Earlier this year, Kadokawa, known for producing manga, anime, and video games, was also hit by a ransomware attack claimed by the BlackSuit threat group. In 2020, Nintendo, another co-owner of the Pokémon franchise, suffered a large-scale data breach that exposed game and console source code, internal documentation, and development tools.
Game Freak’s breach underscores the growing vulnerability of major game developers to sophisticated cyberattacks, as the industry continues to be a prime target for threat actors.

