Imagine spending years building something worth billions. Hundreds of staff. Tight secrecy. Serious investment in keeping it under wraps. Then a teenager with a laptop and a phone call pulls the whole thing apart in an afternoon.
That is roughly what happened when one of the most anticipated video games in history had unreleased footage and internal development material leaked across the internet. The breach did not come through a clever zero-day exploit or months of patient infiltration. It came through social engineering. Someone contacted internal support, convinced staff they were a legitimate colleague, got access to internal communication tools, and walked out with everything.
The company involved had more security budget than most UK small businesses will ever see. It did not matter. The attack targeted people, not systems.
What Social Engineering Actually Looks Like
Social engineering is the practice of manipulating people into handing over access, information, or credentials by pretending to be someone they are not. It is sometimes a phone call. Sometimes an email. Sometimes a message in a collaboration tool that looks like it came from IT support.
The attacker does not need to know your network topology. They need to know enough about your business to sound convincing for thirty seconds. With LinkedIn, a company website, and a little patience, that is not difficult.
In the gaming studio case, internal chat tools were the entry point. For a UK small business, it might be an email asking a member of staff to reset their password via a link. Or a call claiming to be from your internet provider. Or a message in your team chat from what looks like the account of a director, asking someone to transfer a file or approve a payment.
The technical protections your business has in place are largely irrelevant once someone with legitimate credentials is already inside.
Why Small Businesses Are Not Off the Radar
There is a common assumption that attackers only target large organisations. The reality is the opposite. Smaller businesses are often actively preferred because their staff have less formal security training, there are fewer processes in place to verify unusual requests, and the consequences of a successful attack land faster and harder.
A single compromised email account can expose years of client correspondence. A staff member who approves a payment because the request looked like it came from the owner can hand over thousands in minutes. A shared password that gets handed over during a convincing support call can unlock an entire system.
You do not need to be worth billions to be worth targeting. You just need to have something an attacker wants, and most businesses do.
The Part Technology Cannot Fix on Its Own
Strong passwords, multi-factor authentication, and endpoint protection all matter. But none of them stop a member of staff from being manipulated into handing over their credentials directly. No spam filter catches a phone call. No firewall blocks a conversation.
This is why awareness training exists as a discipline in its own right. The goal is not to make every employee a security expert. It is to give them enough understanding to pause when something feels off, and to know what to do when it does. That might be knowing not to hand over credentials over the phone regardless of who is asking. It might be understanding that a message from a director's account asking for an urgent bank transfer should always be verified by a second channel. It might simply be knowing that asking a question before clicking a link is always allowed.
Most staff who fall for social engineering attacks are not careless. They are trying to be helpful. Training addresses the gap between wanting to help and knowing when helping is actually opening a door.
The post Spotting Bad Grammar Is No Longer a Security Strategy covers how convincing modern attacks have become. The bar for a believable impersonation is lower than most people assume.
Access Controls Are the Other Half of the Answer
Even when someone is deceived into handing something over, the damage depends on what that something unlocks. In the gaming studio leak, the attacker reached internal systems with wide access. Had those systems been segmented, with staff only able to access what their role required, the amount of material they could have walked out with would have been smaller.
For a small business, this principle is practical rather than complex. It means your accounts person does not need admin-level access to your IT systems. It means departing staff have access removed the same day they leave. It means a shared admin password used by everyone is replaced by individual logins with appropriate permissions.
Identity and access management for small businesses does not require a dedicated security team. It requires a clear policy on who needs access to what, and a process for keeping that up to date.
What to Do With This
The practical steps here are not expensive or technically complicated. Run a conversation with your team about how social engineering works and what they should do if something feels wrong. Review who in your business has access to what systems and whether that access is still appropriate. Make sure there is a clear, low-friction way for any staff member to raise a concern or verify a suspicious request without feeling like they are making a fuss.
The gaming industry leak will be written about for years. Most of the commentary will focus on the content that was exposed. The more useful lesson is simpler: the most sophisticated systems in the world can be undone by a convincing question aimed at the right person. Your people are your first and last line of defence, and they deserve the tools to do that job well.
If you want to understand where your business currently stands, structured security awareness training is a practical place to start.