After hackers stole a huge data trove from HBO they posted a menacing ransom letter last month in the form of a scrolling video which referenced Game of Thrones.



“Our demand is clear and non-negotiable,” it said, accompanied by the series’ score. “By ignoring this new era, the first victims will be your reputation and your empire ... declare your surrender!”

If the network did not pay a multi-million dollar ransom in bitcoins it would suffer “catastrophic” damage through leaks of emails, financial reports and upcoming, unseen episodes of hit shows, it said, signing off with an ominous addendum to the Game of Thrones injunction: “Winter is coming – HBO is falling.”

The message ended with an image of the Night King, who leads a frozen zombie horde that threatens all living things in the fantasy series.

A month later, it’s still summer for HBO. The Time Warner-owned company apparently paid no ransom, weathered the leaks and despite the possibility of a last minute leak seems poised to screen the Game of Thrones’ seventh season finale as planned this Sunday.

The hackers – at least this time – lost, Andy Kleinick, said the head of the Los Angeles police department’s cyber crimes section, and a supervisor for the secret service’s LA electronic crimes task force. They hyped their threat and misjudged their leverage, he said. “I think it was stupid. They thought because it was Game of Thrones it’d be a big deal.”

Independent cybersecurity experts agreed that HBO seems to have emerged without serious damage despite the data dumps and banner headlines. They cautioned, however, that only HBO and the hackers know the full story. The company declined interview requests for this article.

The experts, who have advised other companies targeted by hackers, described such crises in terms of attacks, breaches, plundering, firewalls, war rooms, psychology and alliances – things familiar to characters in the Seven Kingdoms.

“It’s a continuous evolution between attacker and defender. If you build a 10ft wall sales of 11ft ladders will go up,” said Richard Ford, chief scientist at Forcepoint. Even if HBO won this battle companies should not be complacent, he said. “It may not be you in the crosshairs now but you will be. No company can consider itself immune to the digital threat environment. That motto, winter is coming, has never been more relevant.”

Earlier this year hackers threatened to leak the latest installments of Disney’s Pirates of the Caribbean franchise and Netflix’s Orange is the New Black series. Neither company is known to have paid ransoms.

No company can consider itself immune to the digital threat environment Richard Ford, Forcepoint

HBO’s turn came at the end of June when an individual or group calling itself Mr Smith released four unreleased episodes of various shows and the script of an unreleased Game of Thrones episode. The hacker claimed to have stolen 1.5 terabytes of data, including shows, emails, actors’ personal details and shooting schedules for Westworld’s second season. A follow-up ransom note reportedly demanded $6m to avert further leaks.

Additional, unrelated blows hit the company. In India thieves smuggled a Game of Thrones episode from Prime Focus Technologies, which works with Star India, which carries HBO. HBO’s Nordic and Spanish outlets blundered by prematurely airing another episode. Someone then hacked HBO’s social media accounts.

HBO’s crisis response team would have felt assailed on several fronts, said Ford. “Being inside that sort of war room is a pretty intense experience. You’re jugging multiple things, the CEO is breathing down your neck. Anything that’s moral and legal is fair game. You play whatever cards you can.”

The Mr Smith hack was the most serious, potentially imperiling HBO’s relationship with investors, employees and viewers.

Crisis management experts say that behind the scenes, HBO’s response team would have endured ‘a pretty intense experience’. Photograph: Justin Lane/EPA

HBO appeared to cave in an email dated 27 July which offered the hackers $250,000, only for the hackers to leak the email to the media, along with additional material. “HBO hackers just hit us with another huge data dump,” said Mashable. “Oh boy, they’re quite something.”

But HBO held its nerve, according to anonymous sources who told several outlets the $250,000 was a ruse to buy time.

So far nothing embarrassing has emerged from the leaks, sparing HBO the drip drip of bitchy emails and pay inequality revelations which made Sony squirm during a 2014 attack. “There’s nothing salacious here,” said Richard Levick, head of the crisis-management firm Levick. “The fact that HBO hasn’t had to deal with that was incredibly helpful.”

Two other factors dulled the hackers’ blade. When hit shows leak online most fans ignore the opportunity for illicit, early viewing and and wait for the formal release, which is easier to stream and has no quality glitches.

Piracy also undermines ransom demands because once a show or film is formally released it is invariably bootlegged around the world, voiding hackers’ control over distribution.

Levick said HBO had handled the crisis well. Success, he said, hinged on advance preparation, multi-disciplinary crisis response teams and industry-wide alliances between companies, even competitors, to combat hackers.



Ford, of Forcepoint, said the first step, when hit, was to not panic. “The ones that tend to make horrible mistakes don’t plan in advance.” Crisis teams needed investigators akin to hostage negotiators, he said. “You need those specialists who are skilled at reading people. We give away quite a lot in how we type and how we write.”

The HBO hackers may have no ransom, and the Game of Thrones finale may unfold without glitch, but that did not necessarily signify defeat, said Jeff Pollard, a security analyst at Forrester Research. “These attackers learned a lot. They gained more information about how to make an attack successful and will likely try again.”