In November 2011, Steam experienced a data breach that resulted in unauthorized access to user information. The breach was due to a vulnerability in the platform's password reset functionality.

How many accounts were compromised?

The breach impacted data related to approximately 35 million users.

What data was leaked?

The data exposed in the breach included credit card information, email addresses, encrypted passwords, geographic locations, names, phone numbers, and Steam account usernames.

How was Steam hacked?

Attackers exploited a vulnerability in Steam's password reset functionality, allowing them to bypass the security code input by leaving it blank. This abuse of the "forgot password" feature enabled unauthorized access to user accounts, particularly those without Steam Guard enabled.

Steam's solution

In response to the hack, Steam implemented enhanced security measures to protect its platform and prevent future incidents. This included requiring game developers on Steam to enroll in two-factor authentication by registering their accounts with a phone number to receive SMS-based two-factor codes. The implementation of two-factor authentication aimed to prevent future hijackings of developer accounts and the spread of malware through game updates. Valve also conducted a thorough investigation of the breach, notified affected users, and took steps to ensure user security on the platform.

How do I know if I was affected?

Steam reached out to affected users following the data breach. If you're a Steam user and haven't received a notification, you may visit Have I Been Pwned to check your credentials.

What should affected users do?

In general, affected users should:

1. Change Your Password: Immediately update your password for the breached platform. Make sure the new password is strong and unique, not previously used on any other platform.

2. Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

3. Enable Two-Factor Authentication (2FA): Activate 2FA on the affected account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

4. Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity, and report any unauthorized transactions or changes immediately.

For more specific help and instructions related to Steam's data breach, please visit the Steam Support page directly.

Where can I go to learn more?

For more information on the Steam data breach, check out the following news articles:

• Steam User Accounts Compromised Due to Password Reset Vulnerability

• Reddit post discussing the Steam data breach

• Steam Store Spreads Malware After Hacker Hijacks Developer Accounts