# SHADOWBYT3$ Claims Breach of Nintendo via Third-Party TINYpulse HR-Engagement SaaS Exposure (~859 MB, $2M Extortion)

> Financially motivated extortion-as-a-service actor SHADOWBYT3$ claims to have stolen roughly 859 MB of internal data belonging to Nintendo employees through a third-party exposure of the TINYpulse employee-engagement platform, demanding $2 million and threatening public release. The dataset allegedly includes employee names, corporate emails, employee IDs, W-9 tax forms, bank-statement PDFs, and HR engagement analytics spanning 2016-2026. The claim is unverified; neither Nintendo nor TINYpulse has confirmed it.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0808
- **ID:** TL-2026-0808
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** SHADOWBYT3$
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 12 June 2026 (first surfaced ~17:50 UTC), the extortion-as-a-service (EaaS) actor SHADOWBYT3$ publicly claimed a breach of Nintendo, asserting the theft of approximately 859 MB (reported by some trackers as ~860 MB to ~1 GB) of sensitive data. Critically, the actor and corroborating reporting frame this as a third-party / supply-chain exposure: the data originates from TINYpulse, the SaaS employee-engagement and feedback platform Nintendo used, rather than from a direct compromise of Nintendo's own gaming or corporate infrastructure. SHADOWBYT3$ themselves stated the incident 'doesn't affect nintendo gaming wise it only affects a small amount of employees that work for nintendo and have used tinypulse,' with reporting putting the number of affected employees around 115.

The alleged dataset is HR-centric and PII-heavy: full employee names, corporate email addresses, and employee IDs; bank-statement PDFs and W-9 tax forms (which carry taxpayer identification numbers and therefore materially raise identity-theft and tax-fraud risk); internal engagement surveys, analytics reports, progress plans, 'wins' dashboards, and 'cheers' exports; private workplace conversations; and employee-sentiment / engagement-ranking data spanning 2016-2026. SHADOWBYT3$ posted a proof link via a MEGA cloud-storage folder and routed contact through Telegram and email.

The extortion was time-boxed: a $2 million USD demand with an initial 48-hour ultimatum expiring 15 June 2026, later extended to 16 June 2026 after the actor redirected the demand toward TINYpulse when Nintendo declined to engage. The operation is data-extortion rather than ransomware encryption or operational disruption: classic precision supply-chain targeting of a loosely-secured third-party SaaS integration to bypass a hardened enterprise perimeter. Open-source attack-surface trackers additionally noted large volumes of Nintendo-domain credentials circulating in infostealer logs (reported figures include ~1.24 million compromised user accounts and ~32 exposed third-party employee credentials), and that Nintendo's corporate mail flows through Proofpoint — context for how third-party/credential exposure can seed such claims, though no direct causal link to this specific dataset has been confirmed.

There is no CVE, no malware family, and no disclosed software vulnerability tied to this event; there are no network or file-hash IOCs in the conventional sense. The indicators are the actor's extortion infrastructure (MEGA proof folder, Telegram/email contact) and the categories of exposed data. The claim remains UNCONFIRMED: Nintendo has not issued an official statement confirming or denying it, TINYpulse has not commented, and threat actors routinely exaggerate volume and authenticity to maximize extortion leverage. ESIX impact score is 5.60 (moderate). Defenders should treat this primarily as a third-party-risk, employee-PII-exposure, and credential/phishing-followup scenario.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1555 Credentials from Password Stores
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Sources

- [SHADOWBYT3$ Claim Breach of Nintendo](https://cybersecuritynews.com/shadowbyt3-claim-breach-of-nintendo/)
- [Nintendo Data Breach: Hacker Claims Stealing ~860 MB via TINYpulse Systems](https://www.technadu.com/nintendo-data-breach-hacker-claims-stealing-approximately-860-mb-via-tinypulse-systems/629331/)
- [SHADOWBYT3$ Claims Breach of Nintendo, Alleges Data Theft](https://cyberpress.org/shadowbyt3-claims-breach-nintendo/)
- [Shadowbyt3$ Targets Nintendo via TinyPulse](https://www.dexpose.io/shadowbyt3-targets-nintendo-via-tinypulse/)
- [Ransomware.live victim record: Nintendo Company @ shadowbyt3$](https://www.ransomware.live/id/TmludGVuZG8gQ29tcGFueSAoTmludGVuZG8uY29tKUBzaGFkb3dieXQzJA==)
- [Rumor: Nintendo hit with data breach, hacker steals 859MB via TINYpulse](https://nintendoeverything.com/rumor-nintendo-hit-with-data-breach-hacker-steals-859mb-of-data-via-tinypulse/)
- [Hackmanac cyber alert: Nintendo / SHADOWBYT3$ TINYpulse claim](https://x.com/H4ckmanac/status/2065888547446370472)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0808