TinyPulse / Nintendo Employee Data Extortion
A new-school extortion group calling itself Shadowbyt3$ skipped the ransomware playbook entirely, opting to steal data and demand silence money instead of encrypting anything. Their target wasn't Nintendo's own network — it was TinyPulse, a third-party employee engagement platform, which put Nintendo in the odd position of managing a breach it didn't technically own. We walk through the ransom deadline, what got leaked when Nintendo didn't pay, and why the attackers' account of the stolen data doesn't quite line up with Nintendo's official statement.
We'll also zoom out to the bigger trend here: SaaS and third-party vendor platforms are becoming the preferred point of entry for extortion groups, and Nintendo's just the latest — and most high-profile — name added to a growing list of vendor-side breaches this year.
The Snow Shovelers: A Physical Pentest Breakdown
This one's a genuinely fun read: a physical penetration test where the red team's way into a corporate building was... offering to help shovel snow. We break down the full social engineering pretext, how a fake IT badge story bought them enough trust to get inside, and the surprisingly awkward moment where getting out of the building turned out to be harder than getting in. We also get into how they eventually got caught, and the very avoidable security gaps — open network ports, weak passwords, no MFA — that made the whole thing possible in the first place.
Guest Segment: Kyle Does Pen Testing
We're joined by Kyle for a full guest segment covering his path into penetration testing, his day job, and his recent BSides talk. Expect a deep dive into tool talk — including his honest take on the Flipper Zero and where it's actually useful versus overhyped — plus real advice for anyone trying to break into the field, from home labs to the SANS Holiday Hack Challenge.
Closer: Red Teaming Career Snapshot
We close the show with a numbers-driven look at what red teaming actually pays, since the industry surveys are all over the place — anywhere from $120K to $180K depending on who you ask. We get into why OSCP still matters more than almost any other cert, how long it realistically takes to break into the field, and put the salary question directly to Kyle to see which numbers match what he sees on the ground.
Watch & Listen
VOD: https://youtu.be/5IH0eFZlDis
Twitch: https://twitch.tv/TheDigitalAscent
YouTube: https://youtube.com/@TheDigitalAscent
Spotify: https://creators.spotify.com/pod/profile/digitalascent/
Hosts & Credits
- Hosts: Brent, Matt
- Guest: Kyle
- Technical Design / Production: Brent
Sources
- BleepingComputer — Nintendo confirms data stolen in WebMD subsidiary cyberattack
- Hackread — Nintendo America Employee Data Exposed After Shadowbyt3$ Targets TinyPulse
- Kotaku — Ransomware Group Alleges To Have Stolen Nintendo's Employee Info
- TechRadar — Nintendo confirms data stolen via third-party cyberattack
- Tech Times — Nintendo Data Breach: HR Vendor Attack Exposed Decade of Employee Records
- Rescana — Nintendo Employee Data Breach via TinyPulse SaaS: Analysis
- SC Media — Nintendo confirms employee survey data stolen from third-party service
- The Register — Hackers shoveled snow for company, were rewarded with network admin access
- U.S. Bureau of Labor Statistics — Information Security Analysts Occupational Outlook Handbook
- ZipRecruiter — OSCP Salary Data
- ZipRecruiter — Cyber Red Team Salary Data
- Dice.com — Cybersecurity Salaries: High-Skilled Security Pros See Pay Boost (CyberSN data)
- CyberSN — Red Teamer Salary and Career Path
- SQ Magazine — Cybersecurity Job Statistics 2026: Salaries, Gaps & Growth