The Alleged Breach: What We Know

Reports circulating online indicated that data belonging to approximately 89 million Steam users had surfaced on the darknet. This facts allegedly included sensitive details like phone numbers and one-time SMS verification codes. The news quickly spread, causing alarm among Steam users concerned about the security of their accounts.

Valve’s Response: Addressing the Concerns

Valve, the company behind Steam, has responded to these reports, stating that Steam itself was not directly compromised. Though, they acknowledge that a set of user phone numbers and SMS codes has indeed been exposed. The company is currently investigating how this data was obtained, emphasizing that it may not have originated directly from Steam’s servers.

The leaked data did not associate phone numbers with specific Steam accounts,password information,payment information or other personal data. Old text messages cannot be used to break the security of your Steam Account, and whenever you can change your e-mail address or password on Steam, you will receive a confirmation by e-mail and/or via a secure message.
Valve

This statement provides some reassurance, suggesting that the exposed data is limited in scope and does not include critical information like passwords or payment details. However, the presence of phone numbers and SMS codes still raises security concerns.

Understanding the Risks: SMS-Based Authentication

The inclusion of SMS codes in the leaked data is particularly concerning as SMS-based two-factor authentication (2FA), while better than no 2FA at all, is known to have vulnerabilities. SIM swapping,for example,is a technique where attackers can trick mobile carriers into transferring a victim’s phone number to a SIM card they control,allowing them to intercept SMS codes. While Valve states that old text messages cannot be used to compromise accounts, the potential for misuse remains a valid concern.

According to a recent report by the national institute of Standards and Technology (NIST), SMS-based 2FA is less secure than authenticator app-based 2FA or hardware security keys. NIST recommends phasing out SMS-based 2FA in favor of more secure methods.

recommendations for Steam Users: Enhancing Your Security

While Valve suggests that changing passwords or phone numbers is not immediately necessary, Archynetys recommends taking proactive steps to enhance your Steam account security:

• Enable Steam Guard Mobile authenticator: Valve strongly recommends using the Steam Guard mobile app for two-factor authentication. This method is substantially more secure than SMS-based authentication.
• Review Account Activity: Regularly check your Steam account activity for any suspicious logins or unauthorized transactions.
• Be Wary of Phishing Attempts: Be cautious of any emails or messages asking for your Steam credentials. Always verify the sender’s authenticity before providing any information.
• Use a Strong, Unique Password: Ensure your Steam password is strong, unique, and not used on any other websites. Consider using a password manager to generate and store complex passwords.

Looking Ahead: The Importance of Robust Security Measures

This incident serves as a reminder of the constant need for robust security measures in the online world. As cyber threats evolve, it is crucial for both companies and individuals to prioritize security and adopt best practices to protect sensitive data. By taking proactive steps to secure your Steam account, you can significantly reduce your risk of becoming a victim of cybercrime.