Data Breach at Steam: 89 Million SMS Logs for Sale with Uncertain Origin

A significant data breach involving the gaming platform Steam has surfaced, with claims that 89 million records are being offered for sale on the dark web. An anonymous seller has been attempting to market these records for $5,000, though initial responses indicate little interest and raise doubts about the sensitivity of the leaked information.

Steam, operated by Valve Corporation, is the leading marketplace for video games, boasting over 130 million users. Cybercriminals often target such platforms, as they can gain access to valuable information, including payment details and virtual items that can be resold for profit. The seller, identified as 'Machine1337,' has generated buzz online by stating that the data includes logs of two-factor SMS messages sent to Steam users.

However, upon further examination, it appears that the dataset primarily consists of shipping logs of two-factor authentication SMS messages rather than comprehensive account details. A sample file, consisting of approximately 3,000 lines, reportedly contains around 1,800 unique Portuguese phone numbers along with metadata about the message dispatch, including costs and message content. The authenticity of these records has not been independently verified, but they seem plausible at first glance.

Feedback from online forums suggests a tepid reaction to the leak, with some users comparing the hype to a 'storm in a teacup.' The dataset reportedly includes phone numbers and expired one-time codes but lacks direct access credentials such as usernames, Steam IDs, or password hashes. The implications for Steam users regarding password security remain uncertain, though some users may want to exercise caution.

Those who have utilized SMS codes as a second layer of security for their Steam accounts should be particularly vigilant when reviewing text messages on their mobile devices. There is a potential risk that malicious actors could exploit the compromised phone numbers to launch convincing phishing campaigns, potentially luring users with fake offers of Steam vouchers or threats of account suspension.

The origin of the breach remains unclear. Initial investigations suggest that the data may have been sourced from SMS transmissions via Twilio, a service provider that has denied any security incident related to this leak. Valve has also refuted any collaboration with Twilio and stated that they are actively investigating the source of the leak. The company has assured users that their accounts remain secure, asserting that the leaked information does not link phone numbers to specific Steam accounts, passwords, payment information, or other personal data.

Steam is a major platform for PC gaming, where users typically purchase licenses to access games rather than owning the games outright, as these licenses can be revoked if an account is compromised or deleted. For guidance on acquiring PC games through alternative platforms that offer permanent ownership, users can refer to related articles and resources.