Nintendo has found itself back in the spotlight — and no, it’s not because of another lawsuit against Palworld. Recently, hackers claimed they had breached the company’s servers and accessed the so-called ‘topics file.’ But that’s not all the cybersecurity issues it had to take care of. Nintendo is also dealing with yet another wave of Pokémon leaks, including what appears to be Game Freak’s full development roadmap.
In a statement to Japanese media Sankei Shinbun, the Kyoto-based developer confirmed that a cyberattack did occur. According to Nintendo, part of its external web servers used for displaying official websites had been tampered with. Nevertheless, the Mario company believes that there’s been no evidence of customer data loss, internal access, or business-related leaks.
The security breach claim originally came from a hacker group calling itself Crimson Collective. The group showed off various folders labeled ‘nintendo-topics’ and ‘production-backup,’ leading to speculation online that it had accessed internal game servers. However, those directories are only tied to Nintendo’s website infrastructure, not development systems. It means the breach likely involved backend web files instead of anything related to unreleased or ongoing projects.
Interestingly, not long after Crimson Collective’s announcement, Nintendo got sucker-punched from the Pokémon side of things. A new batch of leaks allegedly spilled the complete development roadmap for Pokémon games through 2030. Complete with information on potentially canceled games and beta builds.
The leaked documents mentioned three massive projects. The first is codename ‘Gaia,’ the Generation 10 games titled Pokémon Wind and Waves, due in 2026. Codename ‘Ringo’ is Pokémon Legends: Galar, planned for a 2027 launch. Lastly, there’s also ‘Seed,’ a generational crossover game featuring Kanto through Sinnoh regions. There’s even talk of spending $10-15 million budget per mainline entry and releasing Generation 11 games in 2030.
Still, this massive Pokémon leak is unrelated to Crimson Collective’s attack; instead, it came from the same leaker behind the 2024 Nintendo Teraleak.
In the end, Nintendo’s latest hacking drama looks more like a web hiccup than a major breach. Nevertheless, with more sensitive data distributed all over the internet, it’s clear that the company’s battle against leaks isn’t quite over yet.
