Hacker Puts Data of 89 Million Steam Users Up for Sale

A hacker known as Machine1337 has allegedly stolen data from 89 million Steam users. The breach was noticed by the company Underdark.ai.

The data is being sold on a darknet forum for $5,000. The database reportedly contains login credentials, SMS messages with one-time codes for Steam, and recipient phone numbers.

Researchers initially speculated that the data might have leaked from Valve itself. However, gaming journalist Mellow_Online1 stated that the Steam developer was not involved. Suspicion then shifted to Twilio, a company that provides two-factor authentication services.

Twilio told BleepingComputer that their internal investigation found no signs of a data breach.

There is no evidence to suggest that Twilio was breached. We have reviewed a sampling of the data found online, and see no indication that this data was obtained from Twilio.

One potential explanation was a leak from an SMS provider acting as an intermediary between Steam and Twilio. However, this theory was also dismissed after Valve informed Mellow_Online1 that it does not use Twilio at all. The exact source of the leak remains undetermined.

Users are advised to enable Steam Guard for additional account protection and change their passwords.