Change your Steam password now

About time I refreshed all my passwords anyway. Thanks for the heads-up.

Still, if you use 2FA your steam account should be safe. But if you use the same password and email on other accounts, those might need a change of password, yeah...
Also, a good time to drop this here https://haveibeenpwned.com/

Thanks for the heads up!

Thank you !

Oof, thanks for the heads up. Might install Bitwarden as well

Whether it's legit or not, it's literally been years since I changed my Steam password, so I have done that anyway.

Well, I was getting pretty tired of the old one anyway.

Obviously activate Steam Guard if you don't have it active, and changing password is not a bad idea, but for now this alleged leak looks highly suspect. 5000$ for tens of millions of steam accounts is pennies, no reputable outlets (or Valve for that matter) seem to have verified authenticity of the data (for now) and MellowOnline1 fella is just some rando.

Edit: Also, IMPORTANT - as always with this type of incidents, be VERY CAREFUL of phishing mails and other social engineering techniques. Regardless of whether leak is real or not other bad actors may use confusion and panic to trick you into obtaining your data. I would be especially weary for any mails from valve claiming your account has been breached and providing you with link to recover it.

i have steam guard is there still a chance something could happen?

this chain of events is weird, first the guy claims steam was hacked, then corrects himself saying it wasn't steam but their external 2fa auth service and then he says Valve approached him and said they don't use said service... so it's actually completely unrelated?

I had an email someone logged into the same country but a different town, mostly i would shrug it off as bad location detection but now?

Thanks for letting us know about this

Yeah, I'm calling bullshit on this one.

on reddit

satoru1111 MOD • 5m ago

To clarify why changing your passwords is basically pointless

1 Steam does not use Twillo for its MFA implementation. Twillo doesnt store the keys for the MFA implementation.

2 Twillo doesn't store passwords, meaning even if you assume Twillo was breached, it has no passwords to leak.

3 Twillo only has a centralized MFA app similar to Google Authenticator. Again this does NOT STORE PASSWORDS

4 If Twillo was compromised, the only possible vector would be an SMS hijacking attack, and that's IF Steam uses Twillo as its SMS intermediary

5 If we assume #4 then, which is a stretch, CHANGING YOUR PASSWORD IS POINTLESS. Its attacking the SMS network. You can change your password every other minute. The attacker can simply generate and SMS code and take over your account that way. Your password is pointless in this scenario

6 If you are 'paranoid' and want to do something 'actually useful' remove your phone number from your account, which still again makes a LOT of assumptions above everything

These datasets are being sold for over $5,000

Until some research entity actually buys said dataset and confirms what it actually contains, I would take anything being claimed with a grain of salt

I use Steam Guard for my account tho, but I don't know what to say if this information is legit..

Just as I was looking at this, I was DMed by a random account claiming to report me accidentally on steam (with screenshot of my profile) and I will be banned, contact the steam discord admin (what...) and you can solve this, watch out!

Wow, somebody posted something on X. What a reliable and totally trustworthy source.

"8bitdefender
•
4h ago
Why risk the biscuit. Go look at the original Solarwinds, Oracle and Okta responses to a group claiming to compromise them. All of them were deny, deny, deny. Then oh yeah we did leak user information.

Not changing your password now is just dumb with how little effort it takes to do so… and if you don’t have Steam Guard enabled, enable ASAP. Hope for the best, prepare for the worse."

amen

Here is the original post by the person who reported it initially, which is Underdark.ai on linkedin. Mellow reported what he saw and warned people and he's added updates from the 11th until today via his Twitter/X account concerning this which included info that Valve provided him. Reading all the updates Mellow made will explain things better.

Likely those 89 million accounts leaked are all the bots that keep begging me to play cs with them and if I can vote for their team.

so Valve answered about this situation

https://steamcommunity.com/games/593110/announcements/detail/533224478739530146

A note about the security of your Steam account
You may have seen reports of leaks of older text messages that had previously been sent to Steam customers. We have examined the leak sample and have determined this was NOT a breach of Steam systems.

We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone.

The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to. The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data. Old text messages cannot be used to breach the security of your Steam account, and whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and/or Steam secure messages.

You do not need to change your passwords or phone numbers as a result of this event. It is a good reminder to treat any account security messages that you have not explicitly requested as suspicious. We recommend regularly checking your Steam account security at any time at

https://store.steampowered.com/account/authorizeddevices

We also recommend setting up the Steam Mobile Authenticator if you haven’t already, as it gives us the best way to send secure messages about your account and your account’s safety.

Steam announcement about the affair
https://store.steampowered.com/news/app/593110/view/533224478739530145
tl; dr Steam wasn't hacked

"Allegedly"
Side effect of Monetization on X. Engagement Farm.
Please kindly do the needful and do not engage, sir / ma'am.