The cyber-attackers who broke down Sony Pictures’ digital doors stole five movies and uploaded them to piracy sites — a move that could cost the studio millions of dollars in lost box office and homevideo revenue.

From the time those films popped up on pirate networks on Nov. 27, they had been downloaded a total of 3.71 million times through Dec. 6, according to piracy-tracking firm Excipio. “Fury,” a World War II drama starring Brad Pitt that bowed in mid-October, led the pack with 3.076 million downloads, followed by “Annie” at 316,793. The other pirated movies were the yet-to-be released titles “Still Alice,” “Mr. Turner” and “To Write Love on Her Arms.”

The film that may be most at risk is the “Annie” reboot, starring Jamie Foxx, Cameron Diaz and Quvenzhane Wallis as the famous orphan. Slated to premiere Dec. 19, it’s the studio’s family entry in the holiday frame. However, analysts said, kid-oriented fare is far less interesting to the typical Internet pirate than are sci-fi or action movies. “My guess is Internet pirates are mostly twentysomething males,” says Phil Contrino, chief analyst at BoxOffice.com. “That’s obviously not who ‘Annie’ is aimed at.”

At the Dec. 7 New York premiere of “Annie” at the Ziegfeld, director Will Gluck told Variety that hearing his movie was among those leaked on the Internet made last week more difficult. “There is no playbook on how to feel about that, so it’s kind of tough to navigate,” he said. “If, ultimately, more people get to see the movie because of that awful thing, then that’s the only silver lining I can hang onto.”

There’s evidence that piracy cuts into revenue, particularly for titles that leak before they hit theaters. In a recent analysis, researchers at Carnegie Mellon U. and the U. of Maryland estimated that pre-release movie piracy causes a 19.1% decrease in revenue compared with piracy that occurs post-release.

Addie Morfoot contributed to this report.

Read Variety’s full coverage of the Sony hack here.