Hero image: Task Bar Hero. Image: Nugem Studio
Player account information from Task Bar Hero was downloaded by an unauthorised third party, the game’s developer has told players.
Nugem Studio published the notice on the game’s Steam page on Thursday, under the title Personal Data Breach Notification. It is dated 12 November 2026.
According to the notice, the third party exploited a vulnerability in the management tool of an external game server service the game uses. The access ran from 17 October to 8 November 2026.
The studio says the service provider told it on 9 November (KST), and that the vulnerability has since been fixed and the access blocked.
The affected accounts are those that played the free-to-play idle game at any time before 15:59 KST on 9 November 2026. That is 5:59pm AEDT, by our conversion.
The exposed details are the Steam profile ID, the game server account ID and sign-up time, the last login time and IP address, device and operating system information, and whether the account had been restricted or deleted.
The notice is direct about what the data cannot do, and about what it could be used for:
“The exposed information cannot be used to log in to your Steam account or to make payments. However, it could be used in scam attempts by someone impersonating the Task Bar Hero team, so please keep the following in mind. The Task Bar Hero team will never contact you first through Steam friend requests, chat, or trade offers.”
It asks players not to log in or verify anything through a link received in a message, and to keep the Steam Guard Mobile Authenticator turned on.
The service provider has reported the incident to Korea’s Personal Information Protection Commission and the Korea Internet & Security Agency, the notice says. As of its date, the studio had received no confirmed reports of misuse.
For players outside Korea, the notice points to the data protection authority in their country of residence. Questions and reports of suspected misuse go to the studio’s support desk, which the notice links twice.
Source: Nugem Studio – Task Bar Hero Personal Data Breach Notification (Steam), TBH: Task Bar Hero (Steam store, AU)