Cyber-attack Timeline: Disney

FAQs on the Disney Cyber Attack

• What happened in the Disney cyber attack?

  In July 2024, the hacktivist group NullBulge claimed it had leaked around 1.2 terabytes of data from The Walt Disney Company's internal Slack workspace, said to span almost 10,000 channels and to include messages, files, information on unreleased projects, source code, some login credentials and links to internal APIs and web pages. The group said it gained access through a compromised employee account. A separate, earlier breach of a Disney Confluence server in June 2024 had already exposed about 2.5 GB of internal corporate data. Disney said it was investigating the matter.

• When did the Disney cyber attack take place?

  The incident unfolded over mid-2024. In early June 2024, a Disney Confluence server was breached and around 2.5 GB of internal corporate data was taken. On 15 July 2024, NullBulge publicly claimed responsibility for leaking roughly 1.2 terabytes of data from Disney's internal Slack, and multiple outlets including CNN reported the leak the same day. Disney confirmed on 15 July 2024 that it was investigating.

• Who was behind the Disney cyber attack?

  The Slack leak was claimed by NullBulge, a self-described hacktivist group that says it acts to protect artists' rights and fair compensation. In emails to the media, the group claimed to be based out of Russia, although this was not independently verified. NullBulge had been hinting at a large Disney release for several weeks before going public. The earlier June 2024 Confluence breach was attributed to separate actors initially seeking Club Penguin game data. 

• How did the attackers gain access to Disney's systems?

   According to the group's own account, NullBulge obtained access to Disney's Slack through a compromised employee account - it described gaining entry via a person with Slack access 'who had cookies', suggesting stolen session cookies or credentials rather than a technical exploit of Slack itself. The separate June 2024 Confluence breach was reported to have used previously exposed credentials. Both routes point to compromised human accounts, rather than a software flaw, as the entry point. 

• What data was leaked in the Disney Slack breach?

  NullBulge claimed to have leaked around 1.2 terabytes of data covering almost 10,000 Slack channels. Reporting indicated the trove included internal messages and files, information on unreleased projects, raw images, computer source code, some login credentials, links to internal APIs and web pages, web push certificates for ABC television stations and assorted design files. Security researchers noted that the data had yet to be fully verified at the time of the leak.

• Why did NullBulge target Disney?

  NullBulge framed the attack as a protest. The group told reporters it wanted to protect artists' rights and compensation, particularly in the age of artificial intelligence, and said Disney was chosen because of how it handles artist contracts, its approach to AI and what the group called its disregard for consumers. The group said it chose to leak the data rather than make demands, arguing that issuing an ultimatum would simply prompt Disney to lock down its systems. 

• Was the Club Penguin Confluence breach part of the same incident?

  It was a separate but related event. In early June 2024, individuals reportedly seeking Club Penguin game data breached a Disney Confluence server using previously exposed credentials and walked away with around 2.5 GB of internal corporate data, including material on corporate strategy, advertising plans, Disney+, internal developer tools and infrastructure. This was distinct from the much larger NullBulge Slack leak disclosed in July 2024, though both highlighted weaknesses in account and credential security.

• Was a ransom demanded or paid in the Disney cyber attack?

  No ransom was reported. Unlike a ransomware attack, NullBulge said it deliberately leaked the data rather than making demands, reasoning that warning Disney first would only let the company lock the attackers out. No ransom demand or payment was identified in reporting, and the incident is best understood as a hacktivist data leak rather than a financially motivated extortion.

• What is NullBulge, the group behind the Disney leak?

  NullBulge is a hacktivist group that presents itself as protecting artists' rights and opposing certain uses of artificial intelligence. Beyond the Disney leak, it has been linked to the distribution of malicious tools aimed at AI users - including a compromised AI image-generation extension hosted on GitHub - used to harvest credentials and data. The group publicises its activity on its blog and social media, and claimed that its site withstood a DDoS attack of around 9.2 million requests after the Disney leak. 

• What was the impact of the Disney data leak?

  The leak exposed a large volume of sensitive internal information, raising concerns about unreleased projects, proprietary source code, internal infrastructure details and credentials that could enable further access. Exposed web push certificates for ABC stations and internal API links were particularly sensitive from a security standpoint. While no customer-data or operational impact was reported, the breach posed reputational and intellectual-property risks and underlined the danger of sensitive material accumulating in collaboration tools such as Slack.

• How did Disney respond to the cyber attack?

  Disney's public response was brief: on 15 July 2024 the company stated that it was investigating the matter. It did not publicly confirm the scope or authenticity of the leaked data at the time. The incident later contributed to wider scrutiny of how large enterprises secure collaboration platforms and manage the volume of sensitive data held within them.

• What can organisations learn from the Disney cyber attack?

  The Disney incident shows how a single compromised employee account can expose vast amounts of sensitive data held in collaboration tools, and how hacktivists motivated by issues such as AI and artists' rights can inflict serious reputational and intellectual-property damage without any ransom. Key lessons include enforcing multi-factor authentication and session-cookie protections, limiting and monitoring access to platforms like Slack and Confluence, minimising the sensitive data stored in chat, and rehearsing response through tabletop exercises. Cyber Management Alliance helps organisations build these capabilities through training, cyber crisis tabletop exercises and incident response planning.