Star Citizen game dev discloses breach affecting user data

Source: Bleeping Computer

Background

Cloud Imperium Games (CIG) is the publisher and developer behind Star Citizen and Squadron 42. Founded in 2012 by Chris Roberts (known for Wing Commander), the California‑based company now operates five studios with over 700 employees. In 2012 the studio announced the multiplayer space‑simulation Star Citizen. Despite a Kickstarter campaign that raised over $2 million, the game remains in “early access” 14 years later.

Breach Disclosure

In a notice posted on its website, CIG revealed that it discovered a breach on 21 January 2026. Attackers gained unauthorized access to some backup systems, obtaining limited personal data of an undisclosed number of users.

“On 21 January 2026, CIG was targeted by a systematic and sophisticated attack, resulting in unauthorised access to some backup systems, including limited access to users’ personal data,” the company said in its website notice.

Data Affected

The compromised data was limited to basic account details:

• Metadata
• Contact details
• Username
• Date of birth
• Name

No credentials, financial information, or passwords were stored in the affected systems.

Company Response

• CIG stated that the breach posed no risk to user safety.
• The access was read‑only; no data injection or modification occurred.
• “No financial or payment information was stored in the affected systems and was not accessible. No passwords were impacted.”
• The company is monitoring the situation, assessing whether any accessed data has been released publicly, and taking steps to prevent further incidents.
• At the time of the notice, there were no indications that the data had been leaked online.

Potential Risks

Although CIG downplayed the incident, the exposed personal information could be leveraged by threat actors in phishing attacks or other social‑engineering schemes.

BleepingComputer reached out to Cloud Imperium Games for comment on user notifications and any ransom demands, but a response was not immediately available.