Update May 14, 6:38PM ET: Valve has confirmed that Steam systems were not breached and identifying user data has not been stolen or accessed by hackers. The company provided clarification in a Steam blog post:
“We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone. The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data. Old text messages cannot be used to breach the security of your Steam account.”
Our original story follows.
Steam has allegedly suffered a data breach in the past week. Details are scant and difficult to confirm, but a known hacker has claimed to be selling a database of more than 89 million user records for the gaming platform with one-time access codes obtained from a third-party vendor used by Steam. If accurate, that would include information about more than two-thirds of Steam’s audience.
The original LinkedIn post identifying a breach suggested that the leaked information came from cloud communication company Twilio. However, a Steam rep said the platform doesn’t use Twilio, so if there has been a breach, it may be through a different vendor providing SMS codes for access.
While we’re genuinely not sure what’s happening at this stage, the whole kerfuffle is a timely reminder to check in on your online security practices. In the case of Steam, Valve has a mobile authentication program called Steam Guard that can help keep your account secure. It’s also a good practice to make sure you’re regularly changing your pass codes, especially when it’s possible that some component of Steam Guard was at the root of this week’s security drama. A password manager can streamline that process. Since phone numbers appear to have been compromised, be extra alert to possible phishing attempts via text.
If you buy something through a link in this article, we may earn commission.