Task Bar Hero data breach: what 23 days of access to a rented game backend exposed

Nugem Studio’s notice is unusually specific about the leaked fields. Read next to the game’s privacy policy, it shows which table was copied, why that table held the rows it did, and what an attacker can do with the data.

What happened in the Task Bar Hero data breach

The notice appeared on TBH: Task Bar Hero’s Steam news feed on November 11, Pacific time. The document itself is dated November 12 in Korea. It is short, and most coverage will stop at the headline: a third-party service used to run the game’s servers had a security vulnerability, and an unauthorized party exploited it between October 17 and November 8, 2026 to download player account information. The provider told the developer on November 9 (KST), patched the hole, blocked access, and notified Korean regulators. The exposed fields cannot be used to log into Steam or make payments.

The field list is where the notice earns its value, and it only makes sense beside the game’s privacy policy. The policy names the processor, lists what the server SDK records on every connection, and sets how long each record lives. Together the two documents give a near-exact reconstruction of the compromised dataset and its blast radius, which is rare in breach reporting. They also correct the framing early summaries reached for. This is not a story about a snooping game client. The client was never the problem.

Why Task Bar Hero needed a rented game backend

Task Bar Hero is a free idle RPG that runs in a strip of the Windows taskbar. Pixel heroes fight, loot, and level while you do something else, and some of the items they find can be listed on the Steam Community Market for Steam Wallet funds. That feature explains the game’s rise. Nugem Studio and Tesseract Studio released it on May 27, 2026, and within days it was in Steam’s top 15 most-played games with more than 100,000 concurrent users. SteamDB logged a 229,730-concurrent milestone. Inven Global reported a peak of 415,374 by June 8, and TheGamer recorded 526,596 on June 14. SteamDB’s all-time peak is 546,130 on June 18, when IGN ranked it third on the platform. Concurrent counts have since settled into the tens of thousands, still a large live-service population for a small idle game. Tesseract has since merged into Nugem, and the October policy revision names Nugem as the sole data controller.

The money drew the crowd you would expect. Cheat forums shipped trainers advertising bypasses for ACTk, the managed-code Unity anti-cheat toolkit the game uses, along with god modes, speedhacks, and a “chest peeker” that reads upcoming loot by intercepting the client’s HTTPS traffic through a locally installed CA certificate. Bot farms inflated concurrent numbers while farming marketable items, as Polygon reported in mid-June. The developers suspended Steam Market listings in early June, reopened them on June 25, and spent the summer fighting server overload.

The anti-cheat also issued game bans, the developer-issued kind that mark a Steam profile, separate from Valve’s automated VAC bans. Enough of them hit innocent players that false-ban threads became a genre of their own, and the price tracker Pricempire noted that the only route to removal was contacting the developer. One quoted ban message reads, “You’ve been permanently banned in TBH: Task Bar Hero by the game’s developers.” Reviews slid to Mixed.

The chain of causes matters for the breach. Marketplace money invited bots and cheats. Bots and cheats forced the studio to move item generation and inventory authority off the client and onto a server, and the mid-June client (version 1.00.12) made that move. A small team running a half-million-concurrent economy was never going to build its own account system, so it rented one. The account table that leaked in November exists because of June decisions meant to stop cheaters. Nothing about it resembles spyware.

Task Bar Hero’s privacy policy: from the “spyware” backlash to server-side collection

At launch the game required players to consent to a broad data-collection policy with no opt-out. Players read the EULA’s scope as permission to inspect their machines, “spyware” accusations spread, and the review score dropped with them. Nugem’s response arrived in hotfix 1.00.04 on May 29: a rewritten policy (v1.3, effective June 6) with two tiers. The first is a Steam ID collected once at first access. The second is telemetry (game version, cumulative playtime, file-integrity status, progress data) collected only when the anti-cheat flags possible cheating. The changelog says plainly why: the old text “was written broadly to cover every possible situation” and described more than the code actually did. Categories that were never collected, including device and access information and error logs, were struck from the document.

That minimization lasted about two weeks, and most retellings miss this part. On June 11, with the game overwhelmed by cheaters and load, the studio announced a dedicated game server and a policy revision (v1.4, effective June 15) that expanded collection to match. The processor list now named AFI Inc., the Korean company behind the Backnd backend-as-a-service, plus Google LLC for an Apps Script endpoint handling statistics and cheat-detection logs. From then on, every server connection automatically recorded the IP address and IP-derived country, device information and device language, OS, nickname, and access timestamps. It also recorded the Steam ID, app ID, and a one-time Steam authentication session ticket used for login.

A June 13 revision (v1.5) reworked consent versioning and corrected the marketplace medium to Steam Wallet funds. An October 22 revision (v1.6) added a full in-game activity-log category covering currency and item movements, growth records, combat summaries, market and mailbox events, and even banner clicks with a country code. So the October breach hit a dataset that the June and October policies had openly described. The May minimization promise was real, but running a server-backed economy overtook it.

Where the breach happened: the Backnd management console

The notice never names the provider. It says only that the vulnerability was in “the management tool of our external game server service.” The privacy policy fills in the name: AFI Inc. (Backnd, thebackend.io), based in the Republic of Korea. It handles account authentication, inventory and game-data storage, activity-log storage, and server-side computation under a GDPR Article 28 processing agreement. Data is stored in Korea, and EU transfers rely on the European Commission’s 2021 adequacy decision.

Backnd is a multi-tenant backend-as-a-service, and its marketing claims more than 6,000 studios. It sells login, user management, data tables, leaderboards, mail, coupons, receipt validation, and an operator console where a studio can inspect user status, join and access information, and game logs. That console is the management plane, and it is the component the notice describes as compromised.

The split between planes is the architectural core of the incident. The game client talks to Backnd’s data plane through the SDK. The studio’s staff talk to the management plane through the console. By design, the management plane can read across the user tables the data plane writes. A flaw there does not touch Valve or the client, and it does not require defeating the anti-cheat. It requires defeating one administrative surface that aggregates everything.

The notice does not disclose the vulnerability class. Nothing public confirms whether it was broken access control, an exposed endpoint, or compromised administrative credentials, so any specific claim would be speculation. The confirmed facts are these:

• Access lasted 23 days, and the attacker downloaded player information.
• The provider reported discovery on November 9, fixed the flaw, and blocked access.
• Administrative permissions were re-inspected on both the provider and developer sides.
• The incident was reported to Korea’s Personal Information Protection Commission (PIPC) and the Korea Internet & Security Agency (KISA).

The public notice followed about three days after the developer learned of the incident. No account count is given. The affected population is every account that played before 15:59 KST on November 9, which for a game that peaked at 546,130 concurrent players means essentially the entire historical player base.

One inference is worth stating carefully. The leaked field list matches the account and user table, and not the much larger activity-log store that v1.6 disclosed. That points to an export of the user-management view instead of a full database dump, which fits a compromise of the console’s user-inspection surface and not the storage layer underneath. This comes from the field list alone and is not confirmed.

Which player data leaked: a field-by-field breakdown

Whether a breach is alarming or minor comes down to what each field means.

Steam profile ID (SteamID64)

This is the 17-digit number in a /profiles/ URL, a 64-bit value built from a fixed base (76561197960265728) plus the account ID. It is public by design and grants nothing on its own. In a leaked row it works as a join key, turning an anonymous backend record into a named Steam profile with a visible inventory, friends list, play history, and market listings. For a game whose items carry wallet value, that is a targeting tool: an attacker can sort the dump by any visible proxy for wealth and concentrate effort where the payoff is highest.

Game server account ID and sign-up date

The account ID is a UUID, Backnd’s internal account key, and it comes paired with the sign-up timestamp. Outside the backend it means nothing. Combined with the SteamID64, it confirms the mapping between Valve’s identity and the studio’s identity, and the sign-up date separates veterans from tourists.

Last-login time and IP address

These are a single snapshot and not a history. Some early write-ups described weeks of IP logs, but the notice lists one last-login IP per account. The policy’s server request logs are a separate category with 30-day retention. A single IP still resolves to an autonomous system, an ISP, and a coarse geography, so it tells an attacker which network the account was last seen on. It cannot track anyone across three weeks, and dynamic allocation, CGNAT, and mobile networks blur even that one point.

Device field: “motherboard model name or computer name”

This is the most technically interesting line in the notice, and the odd pairing comes from the engine. Task Bar Hero is a Unity build (the depot ships GameAssembly.dll and IL2CPP metadata), and Unity’s SystemInfo exposes two relevant properties. On Windows, SystemInfo.deviceModel returns the system model string shown in the System Information screen, formatted “Model (Manufacturer),” which on a self-built desktop is the motherboard’s product name. SystemInfo.deviceName returns the user-defined computer name, the hostname as it appears on the network. A backend SDK that records “device information” gets exactly those strings, which is how a pixel idle game’s account table ends up knowing your B550 board or your PC’s name. The OS type and version come along too.

None of this is a serial number or a MAC address, and thousands of machines share a motherboard model, so the field is a coarse, soft device description and not a unique hardware ID. Paired with a hostname and OS build, though, it stays stable when the IP changes. Hostnames are also quietly personal: people name machines after themselves, and corporate fleets name them after employers and asset tags.

Account status: restricted or deleted

The status flag completes the row. Restricted accounts belong to people who have already fought with the anti-cheat and may be primed for an “appeal” lure. Deleted accounts look odd in a breach until you read the retention schedule. After account deletion, the policy keeps residual withdrawal records (UUID, sign-up date, last access date, OS and device at last access) until a periodic purge that runs at least every 90 days. Other personal information is removed within seven days of withdrawal, and request logs expire at 30 days. The leaked snapshot therefore includes people who had already quit, because the backend was still holding their residual rows on schedule. That is the policy working as written, and it shows how retention rules quietly set the blast radius of a breach.

Is your Steam account at risk? Phishing is the real threat

The notice is correct that none of this logs anyone into Steam. Login rides on the Steam authentication session ticket, which the policy describes as a one-time token. In Steamworks terms, the client obtains a ticket and the server validates it against Valve. The ticket is bound to the app and the account, short-lived, and single-purpose. No password hashes, payment instruments, or reusable session material appear in the field list. The notice also says the data cannot be used to read or tamper with other players’ game data, which is consistent with server-side validation of inventory and progress. Credential-stuffing risk from this dump is close to zero.

What remains is social engineering with receipts. A message that knows your SteamID, your nickname, when you last played, roughly where you connect from, what OS you run, and whether your account was ever restricted can impersonate the studio or Steam support with uncomfortable credibility. The notice’s own warning names the attack the developer fears: the team will never contact you first through Steam friend requests, chat, or trade offers, and you should never log in through a link sent in a message. That reads as a description of the scam template, because it is one.

The marketplace makes it worse. A fake “item recovery” or “market restriction appeal” flow aimed at players with visible inventories is the natural way to monetize this dataset, and the hardware strings let the lure mention your setup for free. None of that needs a second breach.

What Task Bar Hero players should do now

The practical response is short. Keep the Steam Guard mobile authenticator enabled and treat every unsolicited Steam message about this incident as hostile. Verify anything through the official help center at nugemstudio.zendesk.com/hc, never through a link in a chat, and do not share passwords, login codes, or payment details with anyone, which the notice states explicitly. Nothing in the field list requires a Steam password change, though it is cheap insurance if you reuse that password elsewhere. Renaming your PC and tightening profile privacy will not undo the leaked snapshot, but both reduce what future collection and public cross-referencing can add to it. If you were banned or restricted, expect appeal-themed lures aimed at you specifically.

Regulatory impact: PIPC, KISA, and GDPR

The provider’s reports to the PIPC and KISA place the incident under Korea’s Personal Information Protection Act. The notice points affected users to their own data protection authorities and names two for domestic users: Korea’s Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) and the KISA privacy report center (dial 118, privacy.kisa.or.kr).

For EU players, the controller is Nugem Studio and the processor is AFI, so the usual GDPR machinery applies. The Article 33 notification clock runs from the controller’s awareness, which here was November 9, and the public notice landed about three days later. The policy preserves access, erasure, and objection rights, with a documented one-year carve-out for cheat-detection data used to defend sanctions. Nothing public says whether any regulator has opened a formal inquiry. The notice says only that the provider is cooperating with an investigation and that no confirmed misuse of the data had been reported as of publication.

Lessons for studios: securing backend admin consoles

“Third-party bad” is the easy takeaway and the wrong one. Backnd exists so small teams do not have to build account systems, and renting it was a reasonable engineering decision. The failure sat in the management plane of a rented backend, so the lesson concerns how that plane is treated. Admin consoles that can read every user row are high-value targets. Their permissions and exposure deserve the same scrutiny as the game API, and the data they aggregate should be minimized and aged out on purpose, not by accident of a 90-day purge cycle.

Task Bar Hero’s notice is better than most in this genre. It is specific about fields, honest about the provider’s role, and clear about the scam it expects. Yet the dataset it describes was assembled from ordinary, disclosed, reasonable-looking collection decisions, one SDK default at a time. That is the uncomfortable part. The breach took no spyware, only a backend that remembered a little more than anyone was thinking about, and an admin tool that someone else got to use for 23 days.