The unprecedented Pokémon hack covers decades of game secrets. Here’s what it means

Pokémon developer Game Freak confirmed it was hacked in August in a major breach that exposed more than 2,600 employees’ personal information and decades’ worth of Pokémon documents, source code, and other files. The stolen data has been uploaded to the internet during the past week as public knowledge of the scope of the leak continues to grow.

As files are being uploaded to the internet and distributed on forums and Discord, Pokémon fans continue to dig through the information to find new, exciting details. These files consist of evidence of scrapped projects — like a reported WarioWare-esque mobile game — and source code for in-progress builds of Pokémon X, Pokémon Y, and Pokémon Legends: Arceus, which people have already used to get those builds running.

Beyond Game Freak’s statement about the breach, Game Freak, The Pokémon Company, and Nintendo have remained quiet. The material impact of the leaked data isn’t immediately clear, but the cultural implications are widespread; once it’s out there, it can’t be put back in the bag, despite a company’s efforts to take down stolen information.

Confused? We’ll answer your questions.

On Oct. 12, unreleased Pokémon content started to appear on social media, Discord, and forums, spread on Discord by an anonymous hacker who said they breached Game Freak’s internal systems. Following the leaked information spreading online, people noticed that Game Freak published a statement days earlier confirming that it had been hacked in August. Game Freak said more than 2,600 employees’ information was stolen, but did not state whether game data had been taken.

On Oct. 22, an anonymous X account called Centro Leaks shared a screenshot of a GitLab admin account, suggesting the hacked data from the August breach came from there. GitLab is a code repository used by individuals and companies to store large amounts of data. It appears that this is where Game Freak hosted tons of documents related to the Pokémon franchise, and likely where the 1 TB of leaked data came from.

The anonymous hacker claimed on a private Discord server they have a playable version of the upcoming, unreleased title Pokémon Legends: Z-A. However, most of the information released so far has been related to already released projects, be them games or anime.

None of this information was meant to be public, though, like scrapped Pokémon and non-canon lore. The nature of the leak’s contents makes it a slightly different situation than the leaks that affected Wolverine or Grand Theft Auto 6, two unreleased and highly anticipated games that have been targeted by hackers in recent years.

Still, Pokemon fans are clamoring for any shred of information, digging into beta builds of older games to uncover interesting or unknown details. In Discord servers and elsewhere, Pokémon fans are getting early builds of Pokémon games up and running on emulators and poring over the gameplay to look for changed or cut content.

The hacker published decades’ worth of content from multiple generations of Pokémon and its anime counterparts. This includes scrapped Pokémon, concept art, beta builds, and Pokémon sprites. Several unannounced and potentially canceled projects were part of the leaked data, too, including a game that was purportedly about riding Pokémon and another that looked like it was inspired by WarioWare. There were a few details about the next generation of Pokémon games, but not much — again, the hacker said they wouldn’t release that information.

Alongside all of this was a trove of documents with non-canon lore and Pokémon stories written by Game Freak staff, one of which went viral for a mistranslation: For a while, some fans thought Game Freak wrote a disturbing story about fire-type Pokémon Typhlosion kidnapping a girl and having a child with her.

The ethics of consuming information that was stolen from a company — stuff that was never intended to be released — are complicated. Though Game Freak reported that employee information was stolen, it seemingly hasn’t been spread online. That fact is what’s muddying the waters for people looking at the stolen information and art: The personal data is a clear line to not step over, whereas leaked content about decades-old games might feel less questionable.

In an industry that’s as notoriously secretive as the video game industry, it’s understandable why fans would be eager for a peek behind the curtain. However obtained, it is a notable and rare look into game development and canned projects. A look into a major corporation’s process is enticing, and something that lots of people could learn from and appreciate. (The Pokémon modding community, in particular, is particularly interested in looking under the hood.) But at the end of the day, it’s stolen stuff. Even the concept art or unfinished art, as inconsequential as it may seem to players, was illegally acquired and never meant to be shared publicly, which makes the ethics of not consuming this information clearer for some people.

The answer of whether or not it’s OK to look at the leaks is a personal choice — so I can’t answer that for you!

Though the hacker is anonymous, it’s likely Nintendo and The Pokémon Company are already looking into their identity. The company has been known to litigate leaks, even ones that were less consequential than this one.

We can look to a Pokémon Sword and Pokémon Shield leak for an example: The Pokémon Company sued and settled a lawsuit against two people who took photos of an unreleased Sword and Shield guidebook and posted them to Discord. Those people were ordered to pay $150,000 each. In that case, the information leaked was limited just to information in the guidebook, whereas this hack required illegally breaching private servers, then distributing stolen information. Jail time is possible.

None of these companies have responded to Polygon’s request for comment, but the most likely course of action is that they continue to keep quiet publicly. The companies may continue to try to stem the tide of leaks by issuing Digital Millennium Copyright Act (DMCA) takedown notices to people sharing the stolen content, or to pursue legal action against the hacker.

There’s been some worry online that The Pokémon Company would delay Pokémon Legends: Z-A as a result of the leak, but that’s historically unlikely, too.