Valve breaks silence on Steam hack reports claiming to impact 89 million accounts

Valve has issued a statement as reports continued to circulate regarding a possible Steam hack that allegedly impacted “over 89 million accounts,” revealing personal data including SMS logs.

A May 10 LinkedIn post has become the source of major controversy in the PC gaming community. An account known as ‘Underdark AI’ reported a “massive” Steam data breach, supposedly impacting just shy of 90 million users.

The account claimed there was a post on a “well-known dark web forum” wherein a malicious actor was seeking $5,000 in exchange for the data they obtained. Said data allegedly included phone numbers, SMS logs for mobiles attached to accounts, and even possible two-factor authentication texts.

News of the alleged security breach quickly caught wind and has been circulating throughout the week. Now, however, Valve has addressed it head-on, denying there was any such breach of Steam’s systems.

Valve refutes claims of “massive” Steam hack

After days of investigating the matter, Valve issued its own statement on May 14. “The recent leak being reported did not breach Steam systems,” the company said clear as day.

“You may have seen reports of leaks of older text messages that had previously been sent to Steam customers. We have examined the leak sample and have determined this was not a breach of Steam systems.”

While Steam’s cybersecurity team is nonetheless still “digging into the source of the leak,” they have assured that damage was minimal.

Any data that did in fact leak “consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to.”

So while yes, Valve has admitted mobile number data was implicated, “the leaked data did not associate the phone numbers with a Steam account, password information, payment information, or other personal data.”

As such, hackers can allegedly do very little. Given the lack of a meaningful threat, Valve even assured users there’s “no need to change passwords or phone numbers as a result of this event.”