Media reports have emerged that a data leak at a Steam partner company could have exposed the data of 89 million player accounts to the dark web. Valve, the company that owns Steam, has responded and asked whether it’s worth changing passwords due to the leak.
Media reports have emerged that a data leak at a Steam partner company could have exposed the data of 89 million player accounts to the dark web. Valve, the company that owns Steam, has responded and asked whether it’s worth changing passwords due to the leak.
As VG247 reports, the leak came from Twitter user Mellow_Online1, who pointed out a post by Underdark AI on LinkedIn, which claims that a hacker going by the name Machine1337 is claiming on a popular darknet forum that he has access to the records of over 89 million Steam users.
It claims to have been collected from a recent data leak that contained more than usernames and passwords. Further analysis by Underdark AI apparently revealed that its data package contained two-factor SMS logs, message content, metadata, delivery status, and other details.
The source of the leak is the American company Twilio. It provides tools for making and receiving phone calls, sending and receiving text messages, and performing other communication functions using its API. It is mentioned in the logs.
It’s common practice for Valve and other large companies to rely on third-party cloud hosts for tasks like sending users 2FA texts. Accordingly, Steam itself was not compromised.
Twilio said it was taking the allegations seriously and was investigating the incident. The company later denied reports that its systems had been compromised.
«There is no evidence to suggest that Twilio was hacked. We have reviewed a sample of data found online and see no indication that this data was obtained from Twilio,» a company representative commented on the situation.
Steam believes not. The service responded to reports of a data leak involving 89 million accounts and issued a statement.
«We have reviewed a snippet of data from this leak and have concluded that it did NOT lead to a security breach of Steam systems. We are still working to identify the source of the leak, which is complicated by the fact that SMS messages are not encrypted during transmission and are delivered to your phone number by several different services,» the service said in a statement.
According to Steam, the leak only contained old text messages with one-time codes valid for 15 minutes and the phone numbers they were sent to. It did not provide information about which Steam accounts, passwords, payment or other personal information these phone numbers were associated with.
«It is not possible to access your Steam account using legacy SMS messages. Additionally, whenever you use SMS to change your email address or password, you will receive a confirmation email or notification in your Steam Mobile Authenticator,» the company said.
Steam stressed that " players do not need to change their passwords or phone numbers following this incident,» but noted that this situation «is a good reminder» to be cautious about any security messages that were not initiated by the user.
The company advised setting up the Steam Guard mobile authenticator and regularly checking the security status of your Steam account at this link .
