What Happened with the Steam Data Leak?
Valve, the company behind Steam—the world’s top PC gaming platform—denied any system breach following recent data leak rumors. The controversy began when dark web monitor Underdark.ai reported a hacker named Machine1337 was selling records of 89 million Steam users for $5,000.. The hacker even provided sample data and shared a Telegram contact for potential buyers.
What Data Did the Steam Data Breach Actually Expose?
Valve clarified in an official statement that the leak only involved old SMS messages with one-time codes and their recipient phone numbers, despite widespread fears. These one-time codes remained valid for just 15 minutes and had no connection to individual Steam accounts. The company confirmed that the leak did not include passwords, financial data, or personal information. Valve also assured users that the exposed messages do not threaten account security and cannot be used to access or compromise any Steam accounts.
Investigation and Source of the Leak
Cybersecurity outlet Bleeping Computer analyzed roughly 3,000 leaked records and found some messages dated as recently as March. Valve pointed out that this data leak did not originate from Steam’s own servers. Instead, Underdark.ai suggests the leaked information came from Twilio, a cloud communication service that manages two-factor authentication (2FA) codes for Steam and many other platforms.
What Should Steam Users Do Now?
Valve reassures users that there is no need to panic or change passwords and phone numbers immediately. However, the company strongly recommends that users enable the Steam Mobile Authenticator app to boost security and prevent unauthorized account access.
