Cloud Imperium Games (CIG), the developer behind Star Citizen and Squadron 42, disclosed this week that attackers breached its systems in January 2026, gaining unauthorized access to personal data belonging to an undisclosed number of users.
The California-based studio published a notice on its website revealing it detected the breach on January 21, 2026. Attackers accessed backup systems containing basic account information, including metadata, contact details, usernames, dates of birth, and names.
What Was Accessed
CIG was direct about the scope of the exposure. “No financial or payment information was stored in the affected systems and was not accessible. No passwords were impacted, and the access was read-only. No data-injection or modification occurred,” the company stated in its notice.
The company also said it has found no evidence that any accessed data has been leaked publicly, and that it is actively monitoring its systems for signs of further activity.
“We are closely monitoring the situation and our systems to ensure that no further incidents occur,” CIG said. “At this stage, there are no indications of any such activity.”
Phishing Risk Remains
Despite CIG’s position that the incident poses no safety risk to users, the exposed data carries real downstream potential for harm. Personal details such as names, contact information, and usernames are standard raw material for phishing campaigns, where attackers impersonate trusted sources to extract credentials or financial information from targets.
More Read
CIG described the attack as “systematic and sophisticated,” though it offered no further technical details about how attackers gained entry to the backup systems.
About the Company
Cloud Imperium Games was founded in 2012 by Chris Roberts, known for the Wing Commander franchise. The company runs five game studios with more than 700 employees. Star Citizen launched a Kickstarter campaign that same year, raising over $2 million, but the game has remained in early access for 14 years and has not reached a full commercial release.
The studio’s user base is notable for its scale and financial engagement. Many players have spent significant sums on in-game ships and assets, making the community a particularly attractive target for social engineering or phishing operations built on leaked account details.
Unanswered Questions
Key details remain unresolved. It is not publicly known how many users were affected, whether individual notifications have been sent to those whose data was accessed, or whether the attackers issued a ransom demand. CIG did not immediately respond to requests for comment on those points.
The notice itself was described as somewhat obscured on the company’s website rather than prominently announced, a disclosure approach that may draw scrutiny depending on applicable data protection regulations in the jurisdictions where affected users reside.
Photo by Sumeet Ahire on Unsplash
This article is a curated summary based on third-party sources. Source: Read the original article
