Over 400 impacted by breached Unity website

SecurityWeek reports that leading video game software firm Unity Technologies had data from 428 of its users skimmed following the compromise of its SpeedTree 3D vegetation modeling software website.

Illicit code injected into the website's checkout page from Mar. 13 to Aug. 26 allowed the collection of SpeedTree customers' names, addresses, email addresses, access codes, and payment card details, according to Unity's filing with the Office of the Maine Attorney General, which also noted complimentary credit monitoring and identity protection services for affected individuals.

Unity disclosed the breach just after it had alerted gamers regarding a high-severity security issue in Unity Editor, tracked as CVE-2025-59489. Such a vulnerability could be harnessed by threat actors for arbitrary library loading and malicious code execution, which could result in the subsequent compromise of data in devices with Unity-developed apps. Immediate patching of the security flaw has been advised.