An unauthorized third party downloaded Task Bar Hero player information after exploiting a server provider’s management tool, Nugem Studio says. The studio identifies accounts that played before November 9, 2026, at 3:59 p.m. Korea time as affected.
In its notice published on Steam on November 12, the studio says the exposed information alone cannot be used to log in to Steam, make payments, or access and modify other players’ game data. It warns, however, that the information could be used in attempts to impersonate the Task Bar Hero team.
What information was exposed?
The information listed by Nugem Studio includes SteamID64, the account’s server UUID, and the date and time of registration. It also includes the date, time and IP address of the last login.
The list extends to the motherboard model or computer name, operating system type and version, and the account’s restriction or deletion status. The exposure therefore involves both account identifiers and details associated with the device and its last connection.
According to the studio, the third party exploited a vulnerability in a management tool belonging to an external server provider between October 17 and November 8, 2026. The provider informed Nugem Studio on November 9, Korea time, after which the team confirmed the incident.
How to handle suspicious messages
Nugem Studio says its team never contacts players first through a Steam friend request, chat or trade offer. A message claiming to come from the team through one of those channels should therefore be treated with suspicion.
The studio advises players not to open links in suspicious messages or log in or complete verification through a link received in a message. It also asks players never to share a password, login code or payment information, and to keep Steam Guard Mobile Authenticator enabled.
As of the notice, Nugem Studio says it had received no confirmed reports of misuse of the exposed information. That does not establish that misuse has not occurred. For questions or to report a suspicious message related to the incident, the announcement directs players to the studio’s support page.
What the provider and studio have done
The provider fixed the vulnerability and blocked the third party’s access, according to Nugem Studio. The developer also says it worked with the provider to strengthen permissions and security settings for server data, then reviewed the security of developer accounts with access to the servers.
The provider reported the incident to the PIPC and KISA in South Korea and is cooperating with their investigation, the studio says. The fix blocks the access described in the notice, but the information had already been downloaded; the studio’s warning about impersonation remains relevant to affected players.
See also the Task Bar Hero game page.
