Leak at Cloud Imperium Games

On 2 March 2026, Cloud Imperium Games — the studio behind the crowdfunded space game Star Citizen and the single-player Squadron 42 — publicly disclosed a data breach that it had detected on 21 January 2026. The roughly six-week gap between detection and a low-key notice posted to the company's website drew criticism from players and commentators, who pointed to GDPR notification obligations.

The company described the incident as a "systematic and sophisticated attack" that gained unauthorized access to some of its backup systems. The access to user data was read-only: no data was injected or modified, and the intruders obtained a limited subset of basic account information.

Exposed data categories included:

• First and last name
• Username
• Date of birth
• Contact details and associated account metadata

Cloud Imperium stated that passwords and financial or payment information were not stored in the affected systems and were therefore not compromised. The studio did not specify how many accounts were affected, though its player base numbers in the millions. At the time of disclosure the company said it had found no indication that the accessed data had been published online and had received no ransom demand, indicating the incident was contained.