Steam Cyber Attack

Gaming communities worldwide were sent into a flurry of concern recently following reports of a potential massive data breach on Steam, the dominant PC gaming platform boasting over 120 million monthly active users. The initial news, delivered by dark web monitoring group Underdark.ai, painted a worrying picture: a threat actor allegedly offered to sell a staggering 89 million user records for a mere $5,000. This sparked immediate calls for users to bolster their account security.

​The Bad News: Underdark.ai's follow-up report indicated that a sample of the purported data for sale included recent 2025 2FA SMS logs. This leaked information seemingly contained one-time access codes sent to users, along with message content, delivery status, metadata, routing costs, and crucially, phone numbers. The potential exposure of even this limited data understandably caused alarm among Steam users.

The Good News: Valve, the company behind Steam, has stepped forward to address these concerns, and their statement offers a significant sigh of relief. According to Valve, none of the leaked data was ever linked to Steam accounts. Their investigation revealed that the exposed information consisted of older text messages containing one-time codes, which are only valid for a brief 15-minute window, along with the associated phone numbers. Crucially, Valve explicitly stated that the leaked data did not include any association between these phone numbers and Steam accounts, passwords, payment information, or other personal data.

Furthermore, Valve reassured users that these old text messages cannot be exploited to compromise Steam accounts. They also highlighted the existing security measures in place, such as email and Steam secure message confirmations for any SMS-based email or password changes.
​
The Bottom Line: While the news of any data leak is unsettling, Valve's swift response and clarification offer a considerable silver lining. Steam users can take comfort in knowing that their sensitive account information appears to be safe. However, this incident serves as a potent reminder to remain vigilant about online security. Valve strongly recommends that all Steam users who haven't already done so set up the Steam Mobile Authenticator, providing an even more secure method for account protection and communication about account safety. It's also crucial to treat any unsolicited account security messages with suspicion. So, while a potential crisis was averted, the importance of proactive security measures remains paramount for all Steam users.
​

Ep331

Image created by AI