An activist hacking group has alleged that it leaked a substantial amount of Disney's internal communications, including details about unreleased projects, raw images, computer code, and some login credentials.
The group, known as Nullbulge, has claimed responsibility for the breach, asserting that it obtained approximately 1.2 terabytes of data from Disney’s Slack, a popular messaging platform. In an email sent to CNN on Monday, Nullbulge explained that they gained access through “a man with Slack access who had cookies.” The email also indicated that the group is based in Russia.
According to Nullbulge, the user initially attempted to remove them but allowed them to re-enter before the second breach. CNN was unable to independently verify these claims.
Disney issued a statement on Monday, acknowledging the situation and stating that it “is investigating this matter.” The company’s extensive operations span various divisions and platforms, including ESPN, Hulu, Disney+, and ABC News.
The hacking group stated their motivations included concerns about how Disney manages artist contracts and its approach to artificial intelligence (AI), along with what they described as the company's disregard for consumer interests.
Nullbulge had been teasing this major leak over recent weeks on social media. For instance, in June, they posted on X what appeared to be visitor, booking, and revenue data from Disneyland Paris.
The issue of AI has been a contentious topic in recent labor disputes, notably during the Screen Actors Guild and the Writers Guild of America strikes. Writers are worried that AI could replace them in scriptwriting, while actors fear that CGI might entirely replace their roles.
The hackers mentioned that they chose to leak the data rather than negotiate with Disney. “If we said ‘Hello Disney, we have all your Slack data,’ they would immediately lock down and attempt to neutralize us. In a confrontation, it’s better to act first,” the email stated.
This incident recalls the 2014 Sony Pictures hack, which, linked to North Korea, resulted in an international crisis by exposing company emails, celebrity aliases, social security numbers, and entire movie scripts.