\n<\/p>\n
French technology company Shadow has confirmed a data breach involving customers\u2019 personal information.<\/p>\n
The Paris-headquartered startup, which offers gaming through its cloud-based PC service<\/a>, said in an email to customers this week that hackers had accessed their personal information after a successful social engineering attack targeted the company.<\/p>\n \u201cAt the end of September, we were the victim of a social engineering attack targeting one of our employees,\u201d Shadow CEO Eric S\u00e8le said in the email, seen by TechCrunch. \u201cThis highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.\u201d<\/p>\n Shadow said that though its security team took unspecified \u201cimmediate action,\u201d the hackers were able to connect to the management interface of one of the company\u2019s software-as-a-service (SaaS) providers to obtain customers\u2019 private data.<\/p>\n That data includes full names, email addresses, dates of birth, billing addresses and credit card expiry dates. Shadow says no passwords or sensitive banking data were compromised.<\/p>\n An individual who posted on a popular hacking forum on Wednesday claiming responsibility for the Shadow breach said they are selling the stolen database, which allegedly contains the personal data of more than 530,000 Shadow customers. The individual said they were selling the alleged data after they claimed they were ignored by the company.<\/p>\n Shadow spokesperson Thomas Beaufils confirmed the authenticity of the email that the company sent to customers but declined to comment further or answer TechCrunch\u2019s questions. Shadow declined to name the software-as-a-service provider when asked by TechCrunch or say if it knows how many Shadow customers are affected, but the spokesperson did not dispute the hacker\u2019s claims when asked.<\/p>\n Shadow\u2019s email to customers, which has not yet been shared on any of the company\u2019s website or social media channels at the time of writing, says that the company has \u201creinforced the security protocols\u201d it uses with its providers and has upgraded internal systems to \u201crender compromised workstations harmless.\u201d<\/p>\n The company is advising customers to be wary of suspicious-looking emails and to set up multi-factor authentication<\/a> on their accounts.<\/p>\n<\/p><\/div>\n