Video game company Valve is speaking out after rumors of a dark web data breach on its software caught fire on social media.
According to PC Gamer, a LinkedIn post claimed that a well-known dark web forum had breached Steam systems and was “offering a dataset of over 89 million user records for $5,000.”
Here’s everything we know about the claims, Valve’s response, and whether your Steam account is safe.
LinkedIn user Underdark.ai claims a hacker has “deeper access” to the Steam dataset
On Sunday, LinkedIn user Underdark.ai shared a lengthy post that claimed a “threat actor” by the name of Machine1337 had acquired the massive dataset as well as “A Telegram contact for purchase,” “A link to sample data hosted on Gofile,” and “Mentions of internal vendor data, indicating deeper access.”
“The implications here are serious — Steam isn’t just a game platform; it’s a treasure trove of personal and financial data tied to users worldwide,” the post noted. “If this breach is verified, it could lead to widespread phishing, account takeovers, and targeted attacks across the gaming community.”
The post encouraged Steam users to change their passwords on the platform, keep an eye on their email for “suspicious activity,” and stay away from “phishing attempts disguised as game promotions or support messages.”
Later, Underdark.ai provided an update on the breach, saying it had obtained “new evidence” from a leaked sample that “contains real-time 2FA SMS logs routed via Twilio,” a U.S.-based cloud company.
“The data includes message contents, delivery status, metadata, and routing costs — suggesting backend access to a vendor dashboard or API, not Steam directly,” the post added.
Underdark.ai said the new findings stress an increased security risk “via phishing or session hijacking.”
An independent games journalist then tweeted the warning message on X, formerly Twitter, where it went viral.
Yesterday, an alleged major @Steam data breach occurred, compromising over 89 million user records (roughly two-thirds of all Steam accounts).These datasets are being sold for over $5,000 on what appears to be a site akin to Mipped.Mipped alongside their sister sites is a…— Mellow_Online1 (@MellowOnline1) May 11, 2025
Valve assures users that their information is safe after investigating the breach
According to Polygon, Valve shared a post in response to the rumors. In it, the company explains that an investigation regarding the leaked data occurred and confirmed that Steam had not been breached and users do not need to change their passwords or phone numbers.
Valve said the leaked information consisted of old text messages that included now-expired one-time authentication codes. The codes were connected to the phone numbers that obtained them, but the phone numbers themselves were not included in the leak.
“The leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data,” the video game company explained. “Old text messages cannot be used to breach the security of your Steam account, and whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and/or Steam secure messages.
Valve stressed, “You do not need to change your passwords or phone numbers as a result of this event. It is a good reminder to treat any account security messages that you have not explicitly requested as suspicious.”
The video game company said it has not identified the source of the leak. It also explained that the text messages leaked were likely unencrypted and ran through multiple providers.
Tips for keeping your Steam account protected
Though Valve confirmed users’ information is safe, the gaming company recommends taking measures to ensure your accounts are secure. It suggests reviewing Steam’s authorized devices page regularly to make sure you know who has access to your account and to set up the Steam Mobile Authenticator app if you haven’t already.
PC Gamer also suggests getting “a password manager like 1Password.”
“It’s worth it for the security of having complex passwords and the convenience of not having to type ‘6Zm#vR&LUVH%#B’ from memory,” according to the outlet.