Overview

• Valve clarified that the leaked data consisted of historical SMS messages with one-time codes and phone numbers, not tied to account credentials, passwords, or payment information.
• Twilio, initially suspected as the source, denied any breach of its systems, and Valve confirmed it does not use Twilio for its two-factor authentication services.
• The incident is likely a supply-chain compromise involving a third-party vendor rather than a direct breach of Steam’s systems.
• Valve assured users that there is no need to change passwords or phone numbers but recommended enabling the Steam Guard Mobile Authenticator for added security.
• Security experts advised users to remain vigilant against phishing attempts, as the leaked data could be exploited for such scams.