Jay Peters is a news editor covering technology, gaming, and more. He joined The Verge in 2019 after nearly two years at Techmeme.
A leak of old text messages sent to Steam customers with one-time codes for logins was “not a breach of Steam systems,” Valve says in a post published Wednesday.
Valve’s response follows news that a hacker is allegedly in possession of 89 million user records and put them up for sale for $5,000, as BleepingComputer reports. BleepingComputer looked at 3,000 leaked files and found “historic SMS text messages with one-time passcodes for Steam, including the recipient’s phone number.”
While one X user claimed that there is evidence tying the breach to Twilio, a Twilio spokesperson told BleepingComputer that “there is no evidence to suggest that Twilio was breached” and that “we have reviewed a sampling of the data found online, and see no indication that this data was obtained from Twilio.” Valve also told the X user that it does not use Twilio.
“The leak consisted of older text messages that included one-time codes that were only valid for 15-minute time frames and the phone numbers they were sent to,” Valve says in its post. “The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data. Old text messages cannot be used to breach the security of your Steam account, and whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and/or Steam secure messages.”
Valve adds that you don’t need to change your password or phone number following this leak, though it does recommend setting up the Steam Mobile Authenticator.
The company says it’s “still digging into the source of the leak.”
