Gamescom’s Security Failed. Its Response Was Worse

After multiple exhibitors lost laptops, unfinished game builds and critical company data, Gamescom answered with insurance advice, optional guards and a reminder to read the fine print. It should be ashamed of that response.

This story is about more than stolen laptops and a badly judged statement. It is about the need to put ethics back at the centre of business—and why customer success matters most when something has gone seriously wrong. Exhibitors are not merely names on contracts or sources of booth revenue; they are customers who entrusted Gamescom with their work, their equipment and, in some cases, the future of their companies. Genuine customer success is not measured only by ticket sales, attendance figures or whether contractual obligations were technically met. It is measured by how an organisation responds when a customer is harmed: whether it listens, accepts responsibility, offers practical help and protects the relationship before protecting its legal position. Gamescom’s response failed that test. By reaching first for insurance clauses and liability language, it demonstrated the difference between serving customers and merely processing them—and why businesses that abandon empathy and ethics eventually lose the trust no contract can restore.

Commentary — 31 August 2026

Gamescom 2026 closed with the sort of figures its organisers will proudly repeat for the next twelve months: 368,000 visitors and 1,743 exhibitors. For several independent developers, however, the defining image of the event was not a packed exhibition hall or a spectacular new trailer. It was an empty stand, a forced-open cabinet and the realisation that the machines carrying their work had disappeared overnight. (source)

Solo developer Ryan Laley, who was presenting the forthcoming horror game Mimic, reported that his equipment and laptops belonging to other exhibitors had been taken from the business area. He later told Kotaku that he knew of at least seven or eight stolen laptops from that incident. According to Laley, exhibitors had been told that the business hall had round-the-clock security, restricted overnight access and controls intended to prevent equipment from leaving without authorisation. (source)

Publisher iam8bit reported that two laptops used to demonstrate Petal Runner and Escape Academy 2 had also vanished overnight. The immediate loss was not merely the price of two computers. The machines contained unfinished versions of both games, creating the possibility that incomplete software could be leaked while also wrecking a carefully prepared schedule of media appointments. (source)

Elsewhere in the venue, Tessera Studios said it arrived at its Indie Area booth in Hall 10.2 to discover that a cabinet had been forced open. Two laptops and a Steam Deck were missing. According to the studio, those devices contained its Gamescom demonstration as well as personal, company and other critical information. (source)

These were therefore not simply several machines taken from one carelessly unattended table. Publicly documented reports involved multiple exhibitors, different parts of the exhibition centre and at least one locked cabinet that had apparently been physically breached. Developer Joe Henson later said he was aware of at least eight laptops and a Steam Deck being taken across three halls and two nights, although the police and organisers have not yet published a definitive total. (source)

Then Gamescom Reached for the Fine Print

Gamescom’s public statement began reasonably enough, acknowledging the thefts and saying that police investigations were underway. Then it rapidly turned into something resembling a liability disclaimer written by an insurance department. The statement reminded exhibitors that uniformed personnel provide only “general security”, that individual stand guards can be purchased separately and that equipment should be insured against theft. It specifically pointed out that these provisions appeared in the participation conditions and technical guidelines. The organisers then characterised the reports as “individual cases” and argued that, at an event of this size, some people would inevitably try to exploit the situation. (source)

That is not an acceptable answer. It effectively says: We are sorry your equipment disappeared from our supposedly controlled exhibition halls, but you could have bought more security and should have insured it. Every sentence may have been carefully reviewed. Almost every sentence was wrong for the moment.

There was no public commitment in the statement to provide replacement or loan equipment. There was no offer to refund exhibition costs, compensate for cancelled appointments, provide data-forensics assistance or help affected companies manage the risk of unfinished builds and sensitive information escaping into the wild. There was no promise of an independent investigation into overnight access, staffing or security-contracting arrangements. Instead, the organisers explained why the loss was contractually somebody else’s problem. Fine print can allocate liability. It cannot manufacture trust.

Contractually Accurate Does Not Mean Morally Acceptable

Koelnmesse’s participation conditions do, in fact, support much of what Gamescom said. They state that the organiser does not generally assume responsibility for looking after exhibitors’ property. General monitoring of halls, grounds and entrances is assigned to security contractors, but this does not include guarding individual stands. Exhibitors are advised to purchase insurance and may hire additional security from authorised providers. (source). That may become important in any contractual or legal dispute. It does not make the public response decent.

Nobody serious expects Gamescom to create a magical crime-free zone. A major event cannot guarantee that no visitor, contractor, employee or intruder will ever attempt to steal something. But exhibitors can reasonably expect controlled areas to be controlled. They can reasonably ask how somebody apparently entered restricted halls after hours, opened secured furniture and carried multiple conspicuous laptops out of the building. They can reasonably ask what “general security” actually accomplishes if it cannot detect that process. And when those systems appear to fail, the first response should be assistance and accountability—not an upsell for private guards.

Insurance is not a time machine. Even where a policy eventually pays for the hardware, it cannot restore cancelled meetings, recreate an exhibition schedule or eliminate the possibility that unfinished software has been copied. It cannot undo the exposure of company files, stored credentials or personal information. It cannot give a solo developer back a rare opportunity to meet publishers, journalists and potential partners face to face.

For a large publisher, losing a demonstration laptop is a serious operational problem. For an independent developer, it can be an existential blow. Gamescom knows this. Its entire Indie Area is marketed around giving smaller creators access to an audience they would struggle to reach elsewhere. To invite those developers into the event, profit from their participation and then answer a devastating loss by pointing them towards insurance clauses is breathtakingly tone-deaf.

Calling Them “Individual Cases” Makes Things Worse

Technically, every reported theft may have its own police file. In that narrow bureaucratic sense, each one is an individual case. But that phrase was not used in a police database. It was used in a public-relations statement while multiple victims were describing similar losses from the same event. In that context, “individual cases” sounds like minimisation.

Multiple laptops disappeared. Multiple exhibitors were affected. Reports came from different halls. A secured cabinet was allegedly forced open. The losses potentially exposed unpublished games and sensitive company information. Calling all of that “individual cases” does not reassure anyone. It suggests the organisation is more interested in preventing the incidents from being described as a pattern than in explaining what happened.

Likewise, invoking Gamescom’s size as an excuse is particularly cynical. The organisers happily use that enormous scale when selling tickets, attracting sponsors and declaring the event an international success. They cannot then present the same size as an unavoidable obstacle to proper security. Size creates complexity. It also creates revenue, resources and responsibility.

Gamescom Had Already Received a Serious Warning

The 2026 thefts did not emerge against an entirely clean background. During Gamescom 2025, nearly 60 German customs officers inspected almost 150 personnel working for more than 40 security companies. Authorities reported initial indications that nearly 50 workers had not been properly registered for social insurance. They also identified 12 possible cases of benefit abuse and three potential minimum-wage violations. Numerous workers reportedly said it was their first day, while some could not clearly identify their employer beyond knowing a first name. (source)

WDR subsequently reported that many personnel could not produce the required service identification or security-worker identification numbers. Koelnmesse said it checked legal requirements through spot checks. According to WDR, all but one of the workers inspected by customs remained deployed at the event while the findings were being examined. (source)

There is an important correction to the original reporting: the 17-year-old worker highlighted at the time was later described by Koelnmesse as a steward without security responsibilities, rather than a security guard. That distinction matters and should not be ignored. (source). None of the 2025 findings proves that any security worker was involved in the 2026 thefts. There is currently no public evidence identifying the thief or thieves, and it would be irresponsible to suggest otherwise.

What the inspection does prove is that Gamescom and Koelnmesse had already received a highly visible warning about subcontracting, personnel records, worker identification, experience and oversight within the event’s security operation. They had a full year to demonstrate that those concerns had been addressed. That makes the 2026 response even harder to swallow. The public deserved an explanation of what had changed since those findings—not another repetition that security was a high priority.

Previous Allegations Also Deserve Answers

Other complaints have emerged that remain allegations rather than independently verified facts. Ukiyo Studios claimed that it had a computer stolen from a Gamescom booth two years earlier and alleged that somebody associated with the event tried to discourage it from filing a police report because the incident would reflect badly on Gamescom and Cologne. The company also claimed that it had experienced some form of theft during repeated appearances at the event. Gamescom should directly address that allegation rather than allowing it to circulate unanswered. (source)

Separately, Dead by Daylight community director Eric Pope said he questioned an after-hours guard about how booth equipment would be protected and received a dismissive response. That is one person’s account, not proof of an organisation-wide failure, but it adds to the need for a proper review of overnight staffing and supervision. (source)

Dismiss each complaint individually and the organisation can continue calling everything an isolated incident. Examine them together and an uncomfortable question appears: how many warnings are required before “individual cases” become a management problem?

The Industry Provided the Response Gamescom Should Have Provided

The most embarrassing contrast came from elsewhere in the games industry. CD Projekt Red publicly offered assistance and replacement equipment. Joe Henson, the developer behind DON’T SCREAM, reportedly provided the money needed to replace Laley’s stolen hardware. Their support helped persuade Laley to remain at the event despite losing his booth setup. (source)

A fellow developer and another games company moved faster to provide practical help than the organisation running the world’s largest gaming event. That is admirable community spirit. It is also an indictment of Gamescom.

The gaming community should not have to act as an emergency compensation fund whenever the event’s arrangements fail. Gamescom had the institutional resources, supplier relationships and local presence to organise loan machines, emergency technical support and financial assistance immediately. Even without admitting legal liability, it could have helped people continue working while investigations proceeded. Instead, others stepped forward while Gamescom pointed towards its participation conditions.

What Gamescom Should Have Said

A responsible statement would have sounded something like this:

We are deeply sorry. Exhibitors trusted us to protect restricted areas overnight, and their experience did not meet the standard they were entitled to expect. We are providing replacement equipment, technical assistance and direct support while preserving all access and surveillance records for investigators. We will commission an independent review and publish the resulting security improvements before the next event.

That would not have prejudged the police investigation or automatically accepted unlimited legal liability. It would simply have behaved like a competent organisation dealing with people rather than claims files.

Gamescom should now provide a verified account of the number and locations of reported incidents when police restrictions allow. It should confirm that all relevant CCTV, access-control and contractor records have been preserved. It should fund replacement or loan equipment, refund affected exhibitors’ participation costs and provide professional assistance where personal data or unfinished software may have been compromised.

Most importantly, it should commission an independent review covering overnight access, removal of equipment, security staffing levels, contractor and subcontractor vetting, supervision, incident escalation and the actions taken following the 2025 customs inspection. The findings—and the changes made because of them—should be published before Gamescom 2027.

Read the Room

Gamescom should be ashamed of its response. Not because thieves exist. Not because any event can promise absolute security. Not because every loss must automatically make an organiser legally liable for every euro of damage. It should be ashamed because exhibitors suffered serious financial, operational and emotional harm, and the organisation’s first public instinct was to defend itself.

The people affected were not merely customers who had failed to purchase an optional extra. They were creators whose games, demonstrations and personal effort helped make Gamescom worth visiting in the first place. The terms and conditions may protect Gamescom in a courtroom. They will not protect its reputation. This was a moment for responsibility, assistance and humility. Gamescom answered with insurance advice and fine print. It could hardly have read the room more badly.

Police investigations were still underway as of 31 August 2026. The final number of incidents, the identity of those responsible and any connection between the separate reports had not been publicly established.

Primary Sources and Further Reading

• Gamescom’s official statement on the reported thefts
• Ryan Laley’s original report from Gamescom
• iam8bit’s account of its stolen demonstration laptops
• Tessera Studios’ account of its forced cabinet and stolen equipment
• VGC: Numerous Gamescom developers report equipment stolen
• Kotaku: Ryan Laley discusses the business area’s expected overnight security
• GosuGamers: Industry criticism, police investigation and support for affected developers
• Shacknews: Additional security complaints and earlier-theft allegations
• WDR: The 2025 customs inspection of Gamescom security personnel
• WDR follow-up: Identification, vetting and continued deployment concerns
• German Customs: Official release concerning the 2025 inspection
• Koelnmesse’s general conditions covering surveillance, stand security and insurance
• Gamescom’s official 2026 visitor and exhibitor figures