Cloud Imperium Games

Summary

Cloud Imperium Games disclosed that attackers gained unauthorized access to some of its backup systems, obtaining limited personal data such as metadata, contact details, usernames, dates of birth and names. The company stated that no financial information, passwords or credentials were exposed, the access was read‑only and no data was altered or leaked. While it maintains the incident poses no safety risk and is monitoring for any public release of the data, the quiet disclosure—via a website pop‑up rather than email or social media—has drawn criticism, with some users questioning what the metadata contains and expressing concern over the delayed notification.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Cloud Imperium Games (CIG), the California‑based publisher and video game developer founded in 2012 by Chris Roberts, operates five game studios with over 700 employees and is best known for the ongoing early‑access title Star Citizen, which was announced in 2012 after a Kickstarter campaign that raised more than $2 million. On 21 January 2026 CIG discovered that it had been targeted by a systematic and sophisticated attack that resulted in unauthorized access to some of its backup systems, including limited access to users’ personal data. The company stated that the compromised data consisted only of basic account details such as metadata, contact information, username, date of birth and name, and emphasized that no financial or payment information was stored in the affected systems, no passwords were impacted, the access was read‑only and no data injection or modification occurred. CIG said it acted quickly to contain the activity, block further access to the data and its systems, and refreshed security settings to eliminate any ongoing threat. It added that it was still monitoring the situation, taking steps to assess and detect whether any accessed data might be released publicly, and at that time saw no indications of such activity, while maintaining that the incident did not pose a safety risk to users.

The breach disclosure was posted as a message on the Roberts Space Industries website but was not linked to the site’s front page, nor was it distributed via email or announced on Star Citizen’s social media channels; instead, users saw a pop‑up notification when logging into their accounts. The incident only gained wider attention after players reported it to the tech site The Register, prompting coverage in early March 2026. Critics noted the delay in public disclosure, pointing out that six weeks had passed between the breach discovery and the wider notification, although some supporters argued that such a timeframe is not unreasonable for similar incidents. Concerns were raised about the unspecified nature of the “metadata” that was accessed, with some Reddit users warning that if it included email addresses it could enable phishing or social engineering attacks against the user base. CIG acknowledged that threat actors could potentially use the exposed personal information in phishing attempts, while reiterating that no evidence of data leakage had been found and that it continued to monitor for any public release of the accessed information.

Sources

Sources available to members: 2 sources.