Riot Games says the company won't pay a ransom after hackers exfiltrated source code for League of Legends, Teamfight Tactics, and “a legacy anticheat platform”
Alexander Martin / The Record :
Context & Ripple Effects
Riot Games' refusal to pay extends a pattern that has been building across the games industry since Twitch's source code and creator-payout data spilled onto 4chan in late 2021, followed by CD Projekt confirming a ransomware hit that possibly exposed source for unreleased games weeks earlier that year. What distinguishes this incident is the target set: alongside League of Legends and Teamfight Tactics, the attackers took code for a legacy anticheat platform — the very layer Riot relies on to keep its competitive titles trustworthy.
First-order effects
- Riot's security team must now assume cheat developers can study the exfiltrated anticheat source, raising the stakes for an anti-cheat operation whose head has publicly described tactics like discrediting cheat developers.
- The company faces the classic extortion fork immediately: paying would fund future attacks, while refusing bets that the stolen code's leak causes less damage than the ransom costs.
Second-order effects
- Every studio holding valuable source code — CD Projekt and MSI among those already hit — now watches whether Riot's no-payment stance invites a public dump or deters one, and each outcome recalibrates how peers handle their own extortion demands.
- If anticheat-derived cheats surface in League of Legends or Teamfight Tactics, competitive-integrity complaints land on Riot at the same time it is managing cost pressure from its roughly 530-person layoff round.
Third-order effects
- A sustained run of refusals by high-profile targets would erode the core ransomware business model, pushing gangs toward pure leak-and-embarrassment plays rather than payment demands — a shift the DC Police standoff already foreshadowed when disclosure itself was the threat.
- Game studios may converge on treating source code as effectively public, investing in runtime defenses and rapid patching instead of perimeter secrecy around repositories.
The trend: Game companies are shifting from paying ransoms to absorbing source-code exposure as a known cost, betting that refusal starves the extortion economy even as leaks continue.