Valve responds to alleged Steam “data breach” leak of 89 million account details — here’s the full story

by

Fresh insights have emerged concerning a recent suspected data breach involving more than 89 million account details from Steam – a globally renowned gaming platform that boasts the highest number of users among PC gamers, with over 120 million active monthly users worldwide.

Recently, the dark web surveillance team Underdark.ai issued an alert on LinkedIn, revealing that an unidentified hacker called Machine1337 was offering a data trove containing approximately 89 million user records for $5,000. Consequently, this revelation caused widespread concern, prompting numerous news outlets and industry influencers to advise Steam users to update their passwords and activate Two-Factor Authentication (2FA) if they haven’t done so already.

Hey there fellow tech aficionados! Just wanted to share an update on the latest findings from Underdark.ai. In a recent post, they mentioned that they’d stumbled upon some leaked data for sale – and guess what year it was from? Yep, 2025! This data included one-time access codes (OTACs) sent via SMS for two-factor authentication (2FA), including message contents, delivery status, metadata, and even routing costs. To make things even more intriguing, the leaked data came complete with phone numbers. Keep your eyes peeled for any potential security concerns related to this!

It now seems that the initial concern was overblown, as the threat appears to be much less severe than initially believed. Valve has addressed the situation through a statement shared with GamingOnLinux, stating categorically that none of the leaked data had any connection to Steam accounts, implying no cause for user alarm.

The leak involved older text messages containing temporary codes that were active for 15 minutes each and their associated phone numbers. Importantly, the leaked information did not connect these phone numbers with any Steam account details, passwords, payment info, or personal data. To clarify, these texts alone cannot compromise your Steam account security. Whenever a code is utilized to adjust your Steam email or password via SMS, you’ll receive an email confirmation and/or secure messages from Steam as well.

In relation to Steam, this incident doesn’t necessitate changing your password or phone number. It serves as a reminder to be wary of any security-related messages you haven’t explicitly asked for, as they might be suspicious. Valve advises Steam users to consider enabling the Steam Mobile Authenticator if it hasn’t been done yet, as it provides the most secure method for receiving important account and account safety information.

To clarify, a breach involving two-factor authentication text messages and related metadata indeed took place. However, it’s important to note that this incident does not implicate any personal data such as Steam account login information or financial details. If concerns about a significant security breach in your case were triggered by the leak, you can now rest easy knowing that you’re likely unaffected.

It’s uncertain where and how the leak started, but Steam denies it was a breach of their system. Underdark.ai suggested that the source could be cloud communications company Twilio, which they claim provides 2FA services for Steam. However, Steam asserts they aren’t associated with Twilo in any capacity. In response to BleepingComputer’s inquiry, Twilio stated there’s no indication they were hacked; yet, they didn’t clarify whether they have or currently do business with Valve.

Despite initial fears, it’s reassuring to learn directly from Valve that the leaked data isn’t as serious as initially suspected. While a low price tag might have hinted at the data’s lack of danger from the beginning, it’s still a good idea to implement Valve’s Steam Guard Mobile Authenticator 2FA (Two-Factor Authentication) if you haven’t already. Additionally, be vigilant about any unusual messages you receive on Steam, and refrain from clicking suspicious links within them as a precaution against potential phishing attempts.

Read More

2025-05-15 01:39