Overview

• A threat actor, Machine1337, claims to sell a dataset of over 89 million Steam user records on the dark web for $5,000.
• The leaked data reportedly includes expired two-factor authentication (2FA) SMS logs, suggesting a possible breach of a third-party vendor's systems.
• Valve has denied any breach of its systems and clarified that Steam does not use Twilio, a company initially linked to the alleged leak.
• Independent investigations, including by BleepingComputer, have been unable to verify the authenticity or source of the leaked data.
• Users are advised to update passwords, enable the Steam Guard Mobile Authenticator, and remain vigilant against phishing attempts.