Update (05/15/2025): Steam has shared that the information that was leaked did not contain anything beyond phone numbers and old verification text messages (which cannot be used for anything). They are not linked to any other information where wrongdoers can match them to specific accounts. No financial information was affected either, and the leak did not come directly from Steam/Valve. It is still recommended to enable 2FA on your account, as everyone should be making use of this in modern times.
Original Story: In another unfortunate turn of events, there has been another major data breach that allegedly led to the leak of information relating to around 89 million Steam users. This makes up more than half of the platform’s active user base, and it does reveal enough information to be dangerous.
The leak was announced within online black markets by someone who claims to hold the information and is looking to sell it for as much as $5,000. The information is supposed to include user information such as phone numbers and 2FA codes that have been texted to those users from Steam’s automated sign-in system.
Valve (the company behind Steam) hasn’t revealed any information on how the breach might have taken place. It could have been internally or via a third-party partner that it uses for its systems. There haven’t been any discussions yet pertaining to any risks for financial information (things are leaning toward that being unlikely), but there does seem to be enough concern that users should consider changing their passwords just in case. Especially if you are not making use of 2FA. If you are using 2FA, the risk is likely much less to none, but still it would behoot you to give your security settings a once-over to make sure that no one can simply sign in with a username/password alone.
Breaches like these are unfortunate, but it does provide yet another example of the world we live in and why we need to be proactive in protecting ourselves and our information. After all, you don’t want to lose your entire video game library over a simple mistake or act of laziness. Always make sure to use 2FA when available (and if a service/platform doesn’t offer this, it might be smart to move away from it and toward something more secure). Steam has its own mobile authenticator, which is likely the best option to take advantage of.
