Cloud gaming firm Shadow says hackers stole customers’ personal data

techcrunch.com:

French technology company Shadow has confirmed a data breach involving customers’ personal information.

The Paris-headquartered startup, which offers gaming through its cloud-based PC service, said in an email to customers this week that hackers had accessed their personal information after a successful social engineering attack targeted the company.

“At the end of September, we were the victim of a social engineering attack targeting one of our employees,” Shadow CEO Eric Sèle said in the email, seen by TechCrunch. “This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.”

Shadow said that though its security team took unspecified “immediate action,” the hackers were able to connect to the management interface of one of the company’s software-as-a-service (SaaS) providers to obtain customers’ private data.

That data includes full names, email addresses, dates of birth, billing addresses and credit card expiry dates. Shadow says no passwords or sensitive banking data were compromised.

An individual who posted on a popular hacking forum on Wednesday claiming responsibility for the Shadow breach said they are selling the stolen database, which allegedly contains the personal data of more than 530,000 Shadow customers. The individual said they were selling the alleged data after they claimed they were ignored by the company.

Shadow spokesperson Thomas Beaufils confirmed the authenticity of the email that the company sent to customers but declined to comment further or answer TechCrunch’s questions. Shadow declined to name the software-as-a-service provider when asked