Cloud Imperium Games cloudimperiumgames.com Cloud Imperium Games data breach: what happened and what to do
Cloud Imperium Games, the studio behind Star Citizen, detected a breach on January 21, 2026. Attackers reached backup systems and read limited account data. The company says passwords and payment details weren't affected. It hasn't published a total.
View all 13,115 breaches- Breach date
- 21 Jan 2026
- Made public
- 4 Mar 2026
- Data exposed
- Names, Usernames, Dates of birth, Contact details
- Last updated
Cloud Imperium Games (CIG), the developer of Star Citizen and Squadron 42, detected a data breach on January 21, 2026. The company is listed in the California Attorney General's breach notification database. BleepingComputer reported that the disclosure came through a notice on CIG's website.
What happened
According to the company, attackers reached backup systems and had read-only access to limited personal data. CIG says it found no sign that the data was published or shared online, and that it is still monitoring.
What was exposed
CIG describes the data as basic account details: names, usernames, contact details and dates of birth, plus metadata. It says financial and payment information wasn't stored in the affected systems and that passwords weren't affected. The company hasn't published how many accounts were involved.
What this means for you
Names, email addresses and dates of birth are enough for targeted phishing, such as fake Star Citizen support emails or ship-sale scams. Players spend real money in the game, so a convincing fake store page is a realistic risk.
Disclosure
Players criticized the timing. According to PC Gamer, the notice appeared roughly six weeks after the intrusion, and some players only saw it as a pop-up on login.
What to do if you were in it
- 1
Be careful with anything that mentions Star Citizen
Only buy ships and packs from the official RSI site, typed in yourself. Treat emails about account problems or limited-time offers as suspect until you've checked the site directly.
- 2
Turn on two-factor login
Enable two-factor authentication on your RSI account and on the email address attached to it.
- 3
Use a unique password
CIG says passwords weren't affected, but use a password that you don't reuse on other sites.
- 4
Expect phishing that uses real details
With your name, contact details and date of birth in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Cloud Imperium Games breach?
CIG hasn't published a total or a list. If you had a Star Citizen account in January 2026, assume you could be. A free Serus scan shows whether your email appears in known breaches.
What was exposed in the Cloud Imperium Games breach?
According to CIG, names, usernames, contact details, dates of birth and metadata. It says payment information and passwords weren't affected.
Should I change my Star Citizen password?
CIG says passwords weren't affected. Changing yours and turning on two-factor login is still a cheap precaution.
Sources
- oag.ca.gov/privacy/databreach/list
- bleepingcomputer.com/news/security/star-citizen-game-dev-discloses-breach-affecting-user-data
- pcgamer.com/games/sim/star-citizen-studio-suffered-a-data-breach-in-january-and-some-players-arent-happy-with-the-very-quiet-disclosure-that-only-happened-this-week
- teiss.co.uk/news/cloud-imperium-games-confirms-january-breach-exposed-limited-user-account-data-17173
Something wrong or out of date? Tell us and we'll re-check it.
