Cloud Imperium Says January Breach Exposed Limited Star Citizen User Data

What Cloud Imperium disclosed

According to a March 3, 2026 BleepingComputer report citing Cloud Imperium Games (CIG), the studio said it was targeted on January 21, 2026 and attackers gained unauthorized read-only access to some backup systems. CIG describes the exposed information as limited personal account data, not core credential or payment systems.

The affected fields listed by the company include metadata, contact details, username, date of birth, and name. CIG also states that no financial or payment information was stored in the impacted systems and no passwords were affected.

Company risk framing and technical scope

CIG's notice, as quoted in the report, says there was no data injection or modification and that access was read-only. The company adds that it has not found evidence so far that accessed data has been leaked publicly. It also says monitoring remains active while it continues assessment.

That scope statement matters because breach severity is often determined by exactly which systems were reachable. A backup-system exposure with personal profile data still creates real downstream risk, especially targeted phishing and identity correlation attacks, even without direct credential theft.

Open questions noted in reporting

BleepingComputer said it contacted CIG to ask whether affected users had been notified and whether any ransom demand had been received, and reported that no response was immediately available at publication time. This leaves notification timing and attacker intent as key follow-up items for users tracking the incident.

Community reaction in r/Games

The linked r/Games thread reached 374 points and 44 comments at crawl time. Discussion centered on two themes: skepticism about disclosure timing and concern that even "basic" personal fields can be weaponized through phishing. That response aligns with broader industry practice, where limited-profile exposures are treated as lower impact than credential loss, but still operationally significant.

Source: BleepingComputer · CIG notice · Reddit discussion