The manager of the company (we can guess likely the CEO since it's a small startup) was infected by a trojan that stole passwords from his computer, but they're certain it didn't infect the network because they "wiped the hard drive." And it couldn't have got to user data because that's hosted in the cloud. Of course the fact the login details are likely on infected computers makes no difference at all...

Yeah usually I am the first to grab my pitchforks against tech giants like Google but the devs are only telling a one sided story here and their business looks far from legit, and that team of amazing devs doesn't seem very competent either if they keep installing trojans.

Note that I am the "OP" as in I posted the link to HN but I am not the author or the developer whose story this is about.

Regarding https, looks like the parent comment linked to the "www" version of their site. Their non-www version does have https:

https://6acegames.com

Not defending the author's cleanliness or shadiness, just pointing out the facts.