Valve Corporation, the owner of Steam, faced a potential breach involving the leak of 89 million Steam user records with one-time access codes. The data was advertised for sale by a threat actor known as Machine1337. A sample of 3,000 records, containing historic SMS text messages with one-time passcodes for Steam, was examined by BleepingComputer. The incident is suspected to be a supply-chain compromise involving Twilio, a cloud communications company providing APIs for SMS and 2FA messages. Twilio denied any breach, but acknowledged investigating the situation. The data's origin is unclear, but it may come from an SMS provider intermediating communication between Twilio and Steam users. Steam users are advised to enable Steam Guard Mobile Authenticator for added security.
TPRM report: https://scoringcyber.rankiteo.com/company/valve-corporation
"id": "val546051425",
"linkid": "valve-corporation",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"