Star Citizen developer draws ire over delayed data breach disclosure

Gamers have criticised Cloud Imperium Games after it quietly revealed a data breach - weeks after discovering the incident.

The California-based studio detected unauthorised access to some of its systems on 21st January, but disclosed it later through a short notice posted on its website.

Players accused the company of failing to communicate openly.

The company said threat actors carried out a "systematic and sophisticated attack” and were able to access certain backup systems that contained users’ “limited personal information.”

The data accessed included details such as usernames, real names, dates of birth and information.

"No financial or payment information was stored in the affected systems and was not accessible," the company said.

It added that passwords were not compromised and that the access was read-only, meaning attackers could not alter or inject data.

Reassurances over payment data and passwords, however, are unlikely to soothe people who have had their personal information exposed; even limited personal information can be valuable to criminals.

Names, email addresses and dates of birth can be used to craft targeted phishing campaigns, particularly when combined with other data already circulating online.

Some players say the bigger issue is how the incident was communicated.

They argue that the notice was difficult to find and the company failed to notify affected users directly.

One player on the company's forums asked: "Where is the email and front-page notice?"

Another user said they were frustrated by the delay, adding that the message appeared nearly a month after the breach was discovered.

"What upsets me, is the lack of communication, and after a !month!, you get a basically hidden message, that something happened," wrote another player.

Plenty of others have decided CIG has breached one law or another and expect action, though whether that is the case is unclear – the interpretation of the EU's General Data Protection Regulation, for example, is subjective.

Although the regulation places a firm number on how long a company has to notify its relevant data protection authority after becoming aware of a breach (72 hours), the same does not apply to notifying affected members of the public. It simply specifies that should be done “without undue delay.”

Cloud Imperium Games was founded in 2012 by developer Chris Roberts, known for the classic space-combat series Wing Commander .

Its flagship project, Star Citizen , is an ambitious multiplayer space simulation that raised more than $2m in its initial crowdfunding campaign and has since attracted hundreds of millions of dollars from supporters.

Despite more than a decade of development, the game remains in an early-access phase.

The company says its community numbers in the millions but has not disclosed how many accounts may have been affected by the breach.

"We are closely monitoring the situation and our systems to ensure that no further incidents occur," the company said.

"We are also taking steps to assess and detect whether any data that was accessed is released publicly. At this stage, there are no indications of any such activity."