Loading story…
Cloud Imperium Games (CIG) disclosed that it suffered an IT incident on January 21 described as a “systematic and sophisticated attack,” resulting in unauthorized access to some backup systems and limited access to users’ personal data. CIG stated the exposed information was limited to basic account details such as names, usernames, contact information, and dates of birth, and asserted that no passwords were impacted, no financial/payment data was accessible, access was read-only, and there was no data modification.
The disclosure triggered backlash from users over how and when the company communicated the breach, with reporting highlighting that CIG initially surfaced the incident via a low-visibility website “service alert” popup rather than prominent notices or direct outreach. Coverage also emphasized that even “basic” identity and contact data can materially increase phishing and social-engineering risk, especially when combined with other breached datasets to build richer victim profiles.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Following the disclosure, users and reporters criticized Cloud Imperium Games for delaying notice of the breach and using a subtle website popup instead of direct email or a prominent announcement. Coverage highlighted that even the disclosed "basic" personal data could still be useful for phishing and identity-targeting.
About a month after the attack, Cloud Imperium Games disclosed the incident through a low-visibility website "Service Alert" popup and linked notice. The company said exposed data was limited to basic account details such as contact information, usernames, names, and dates of birth, and that it was monitoring for any public release of the data.
After detecting the attack, Cloud Imperium Games said it contained the activity, blocked further unauthorized access, and refreshed security settings. The company also stated there was no impact to passwords, no financial or payment data exposure, and no evidence of data modification.
Cloud Imperium Games said a "systematic and sophisticated attack" targeted its systems on 2026-01-21. The incident led to unauthorized access to some backup systems and limited read-only access to certain users' personal data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcetheregister.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
VRChat disclosed that unauthorized access to its cloud environment exposed data belonging to **2,436,782 users** after an intrusion between May 10 and May 12. According to the company’s filing, the compromised information included VRChat usernames, associated email addresses, **VRChat+** subscription status, login history, device and hardware identifiers, IP addresses, and linked **Steam** or **Meta** user IDs. VRChat said passwords, payment card data, and government ID documents used for age verification were not believed to be affected. The company said it contained the incident, added security controls, and brought in external security experts to monitor for further threats. The breach raises immediate risks of phishing, account targeting, and credential-stuffing attempts against users who may have reused passwords on other services, while linked platform identifiers could enable broader identity correlation. Reporting also noted that VRChat disclosed the incident through a filing with Maine’s attorney general rather than a broad public announcement, and it did not offer identity theft or credit monitoring services.
Jun 29, 2026
Canada’s **Canadian Investment Regulatory Organization (CIRO)** confirmed a data breach affecting approximately **750,000 investors**, attributing the incident to a **sophisticated phishing attack** detected in **August 2025**. CIRO said it conducted an extensive forensic investigation (citing **9,000+ hours** of review by a third-party forensic firm) and determined that a limited subset of investigative, compliance, and market-surveillance data—including investor information—was **copied** from its systems; CIRO also reported that some systems were taken offline during response efforts but that critical operations were not disrupted. CIRO warned that exposed data may include **dates of birth, phone numbers, annual income, Social Insurance Numbers, government-issued ID numbers, investment account numbers, and account statements**, while stating that **login credentials were not at risk**. The organization said it has **no evidence of misuse** and has not observed related dark-web exposure to date, and it reported notifying law enforcement and relevant authorities (including privacy commissioners) while offering affected individuals **two years of credit monitoring and identity theft protection**.
Jun 29, 2026