It’s unbelievable that there’s more negative news surrounding Star Citizen. Version 1.0 still hasn’t been released.

Cloud Imperium Games (CIG), the studio behind Star Citizen, reported a data breach following a systematic and sophisticated attack. This resulted in unauthorized access to some of its backup systems, including limited access to user personal data. The studio claims that the incident does not pose a security risk and that no financial or payment information was stolen. However, the studio is facing criticism for how it disclosed the incident and how long it took to do so. A message about the data breach was posted on the Roberts Space Industries website:

“On January 21, 2026, CIG was targeted by a systematic and sophisticated attack, resulting in unauthorized access to some backup systems, including limited access to users’ personal data. CIG acted quickly to contain the activity, block further access to the data, and refresh security settings to ensure there is no threat to our games or users. While CIG is still monitoring the situation, we do not consider the incident to pose a risk to our users’ safety. The impacted data relates only to basic account details, such as metadata, contact details, username, date of birth, and name.
No financial or payment information was stored in the affected systems or accessible. No passwords were impacted, and the access was read-only. There was no data injection or modification. We are closely monitoring the situation and our systems to prevent further incidents. We are also taking steps to assess and detect whether any accessed data is released publicly. Currently, there are no indications of such activity. We are sharing this update in the interest of transparency. However, we do not anticipate that this incident will impact our users,” the statement says.

This message is not listed as a link on the RSI homepage. According to the Star Citizen subreddit, users were not emailed about the security breach. It is not mentioned on Star Citizen‘s social media channels either. Instead, the announcement reportedly appears in a pop-up window when players log into their Star Citizen accounts. The incident only became more widely known after players reported it to The Register. Some have criticized how long it took for the breach to be made public, though supporters argue that six weeks is not unreasonable in such cases. For example, it took months for the Notepad++ data breach to come to light. However, when Insomniac suffered a serious hacker attack in 2023, they made the incident public within a week.

Comment
byu/arcticgamez from discussion
instarcitizen

Even more concerning is the fact that data was stolen. Although CIG downplayed the risk, emphasizing that no financial information was among the stolen data, some followers believe the stolen information could be used for social engineering attacks. This is especially concerning since the studio did not specify what the metadata contained. According to one Reddit user, if the stolen data included emails, names, and dates of birth, hackers could send dangerous phishing emails to the entire user base.

Source: PCGamer, The Register