Valve Confirms No Steam User Data Breach in Hack

Valve has refuted recent reports claiming its Steam platform experienced a "major" data breach, firmly stating there was "NO breach" of Steam's systems.

While concerns arose over claims that 89 million user records were exposed, Steam's investigation found that only outdated text messages containing time-sensitive verification codes were leaked—none of which contained personal information.

In an official statement on Steam, Valve clarified: "Our analysis of the leaked data confirms it included only expired SMS verification codes and the associated phone numbers. Importantly, this data did not link phone numbers to Steam accounts, passwords, payment details, or any private user information."

The company further reassured users: "These old codes pose no security risk, as they expire within 15 minutes. Additionally, any account changes via SMS trigger email and Secure Mobile App notifications for verification."

Valve took the opportunity to reinforce security measures, recommending that all users enable Steam Mobile Authenticator for two-factor authentication—calling it "the most effective safeguard for account security notifications."

With rising cyber threats and Steam's massive user base exceeding 89 million accounts, initial concerns were understandable. The gaming industry has faced severe breaches before, most notably 2011's month-long PlayStation Network outage compromising 77 million accounts.

Corporate data also remains vulnerable. In October 2023, Pokémon developer Game Freak suffered leaks exposing employee records and development roadmaps. Earlier that year, Sony confirmed breaches affecting 7,000 current and former staff, while December saw Insomniac Games' Marvel's Spider-Man files leaked in a high-profile attack.