Valve Debunks Alleged Steam Data Breach

https://www.xda-developers.com/89-million-steam-account-deta…
https://www.xda-developers.com/valve-confirms-the-steam-brea…

Maybe consider this as a PSA and enable MFA and/or change your passwords!

FYI, if you already have MFA, threat actors may try to trick you into getting you to supply MFA token via phishing emails.


You may have seen reports of leaks of older text messages that had previously been sent to Steam customers. We have examined the leak sample and have determined this was NOT a breach of Steam systems.

We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone.

The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data. Old text messages cannot be used to breach the security of your Steam account, and whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and/or Steam secure messages.

You do not need to change your passwords or phone numbers as a result of this event. It is a good reminder to treat any account security messages that you have not explicitly requested as suspicious. We recommend regularly checking your Steam account security at any time at

https://store.steampowered.com/account/authorizeddevices

We also recommend setting up the Steam Mobile Authenticator if you haven’t already, as it gives us the best way to send secure messages about your account and your account’s safety.

https://store.steampowered.com/news/app/593110/view/53322447…

Related Stores

Steam
Steam

Comments

  • Cs2 skins……………………

  • +7

    Before anyone gets too worried, the key piece of information is:

    The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data.

    OP, fix your topic title, no "credentials" leaked.

    Whoever manages Steams mobile 2FA system was breached. No need to update passwords, definitely a good time to start using the Steam app for 2FA instead of SMS (because SMS 2FA is stupid anyway).

    • updated

    • You can just remove Steam 2fa via SMS 2fa anyway so no less secure.

  • +1

    Bit of a non-story right? There's now a list of phone numbers that are probably associated with a steam account. There's probably a lot of other ways to work that out.

    • topic changed, initially it sounded like actual credentials leaked…

Login or Join to leave a comment