Cloud Imperium Games confirms January breach exposed limited user account data

Cloud Imperium Games, a California-based video game developer and publisher known for the titles Star Citizen and Squadron 42, disclosed that attackers gained unauthorized access to some user data during a cyberattack discovered in January 2026.

The company detected the breach on Jan. 21 after a “systematic and sophisticated attack” targeted internal systems and allowed unauthorized access to certain backup infrastructure. The intrusion resulted in limited exposure of basic account information belonging to an undisclosed number of users.

Cloud Imperium Games stated that the affected systems contained only basic account details, including metadata, contact information, usernames, dates of birth and user names. The company emphasized that the compromised systems did not store passwords, payment data or other financial information.

The access obtained by the attackers was read-only, and internal reviews have not identified any evidence of data injection, modification or tampering within the affected systems. Financial and payment records were not present in the compromised infrastructure and therefore were not accessible during the incident.

Cloud Imperium Games indicated that there are currently no signs that any of the accessed data has been published or distributed online. The company continues to monitor its systems and external channels to detect whether any of the data becomes publicly available.

The studio reported that it is actively assessing the situation and strengthening monitoring measures to prevent additional incidents. At this stage, internal evaluations indicate that the breach does not pose a direct safety risk to users.

Cloud Imperium Games was founded in 2012 by game developer Chris Roberts, known for creating the Wing Commander franchise. The company operates five studios and employs more than 700 staff members.

The developer introduced the multiplayer space simulation game Star Citizen in 2012 following a crowdfunding campaign that raised more than $2 million. Despite its early financial backing, the game remains in an early access stage more than a decade after its initial announcement.

Although the company stated that the breach is unlikely to affect users, exposure of personal details such as names, email addresses and birth dates can increase the risk of targeted phishing campaigns if malicious actors attempt to exploit the information.