Details on 89M Steam Accounts Leaked, Valve Says Systems Not Breached

UPDATE: In a statement, Valve says the leak involves “older text messages that had previously been sent to Steam customers” and is “NOT a breach of Steam systems.”

“We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone,” it says. However, the phone numbers that received the one-time codes are not associated with a Steam account, password information, payment information or other personal data.

A password reset is not required, it adds, but this is “a good reminder to treat any account security messages that you have not explicitly requested as suspicious.” Valve recommends regularly checking your Steam account security and setting up the Steam Mobile Authenticator.

Original Story:
Account details of 89 million Steam PC gamers are up for sale on the dark web.

Spotted by Underdark.ai on LinkedIn and highlighted by XDA, the dataset is on sale on a well-known dark web forum for $5,000. A hacker who goes by Machine1337 provided details from the data to prove its authenticity. That has yet to be confirmed, but if you’ve ever used Steam, now is a good time to update your password.

If you reuse your Steam password on other online accounts, meanwhile, you should also update those services. And keep an eye on your email for potential phishing attacks, especially around the topic of gaming.

The source of the leak is unclear right now. Steam owner Valve shot down reports that it’s linked to cloud software company Twilio.

We asked Valve to confirm whether a breach had occurred and, if so, what next steps it recommends. We’ll update this story when we hear back.

Steam celebrated a major milestone earlier this year when it hit 40 million active users in March, suggesting the breach potentially includes data on inactive accounts or occasional Steam users.

Steam also made headlines in March when a demo for a fake title called Sniper: Phantom’s Resolution was found to be malware. Rather than hosting the malware directly on Steam, the listing linked to a different website to fool users into installing a computer virus.

Get Our Best Stories!

Stay Safe With the Latest Security News and Updates

Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.

By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.

Thanks for signing up!

Your subscription has been confirmed. Keep an eye on your inbox!

About James Peckham

Reporter

I’ve written tech news for over a decade, and as a Reporter at PCMag, I cover the latest developments across the gadgets and services you use every day. Previously, I worked for Android Police, TechRadar, and more.

Read James’s full bio

Read the latest from James Peckham