Valve says the reported leak of texts sent to Steam customers “was not a breach of Steam systems.”
The company behind the popular PC game store responded to reports of a data breach in a post on Steam. In it, Valve outlined the details of the leak and said that Steam users don’t need to change passwords or phone numbers because of the leak.
“The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data,” Valve explained.
The company also noted that old texts can’t be used to breach the security of Steam accounts.
Valve’s response comes after reports detailed a breach impacting 89 million Steam accounts after data was put up for sale on the dark web. Initial reports suggested that the breach was related to Twilio, which allegedly handled the two-factor authentication (2FA) codes sent over SMS to authenticate Steam users.
However, Twilio has since denied involvement in the breach, and Valve contacted the original source of reporting about the breach, informing them that it does not use Twilio at all.
“We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone,” Valve wrote in its post.
For now, it remains unclear where the leak originated. However, regardless of the source, it seems like the leaked data isn’t as big of a concern as initially reported. Still, the event serves as a good reminder to be wary of suspicious messages and avoid clicking on links in messages from unverified sources.
Source: Valve
MobileSyrup may earn a commission from purchases made via our links, which helps fund the journalism we provide free on our website. These links do not influence our editorial content. Support us here.
