Steam User Records Leaked Online

Steam User Records Leaked Online

A hacker claims to have obtained 89 million Steam user records, which they are selling online. The leaked data includes historic SMS text messages with one-time passcodes for Steam.

Details of the Leak

According to a report by BleepingComputer, an examination of 3,000 leaked files revealed the presence of these text messages. The files contained:

  • Historic SMS text messages with one-time passcodes for Steam
  • The recipient’s phone number

One user on X suggested that evidence links the breach to Twilio. However, a Twilio spokesperson disputed this claim, stating, "There is no evidence to suggest that Twilio was breached." They also mentioned that after reviewing a sampling of the data found online, "we see no indication that this data was obtained from Twilio."

Valve Corporation has denied using Twilio services, confirming that they do not utilize Twilio.

Nature of the Leaked Data

The leaked data consists of older text messages containing one-time codes valid for 15-minute time frames and associated phone numbers. Notably, these phone numbers are not linked to any personal information such as passwords or payment details.

Security Implications

Older text messages cannot be used to compromise Steam account security because:

  • Users receive confirmation via email or secure message whenever a code is used for changes like email or password updates through SMS.

While users do not need to change their passwords or phone numbers following this leak, Valve recommends setting up the Steam Mobile Authenticator as an added security measure.

Valve’s Response

In response to concerns about potential vulnerabilities in its system, Valve stated:

"We’ve been made aware by some users who have seen their old two-factor authentication (2FA) codes posted on various websites and social media platforms."

They emphasized that:

"Please note that older texts cannot be used against you since we send confirmation via email or secure message whenever you use your code for changes like email or password updates through SMS."

Valve also reiterated the importance of setting up its mobile authenticator app as an additional layer of protection against unauthorized access:

"We recommend enabling our mobile authenticator app as an additional layer of protection against unauthorized access."

FacebooktwitterlinkedinrssyoutubeFacebooktwitterlinkedinrssyoutube
FacebooktwitterredditpinterestlinkedinmailFacebooktwitterredditpinterestlinkedinmail

Leave a Comment

Your email address will not be published. Required fields are marked *