Steam Gets Pwned Via Third Party Service Getting Pwned

If you have a Steam account, it’s time to change your password. Here’s why:

Yesterday, an alleged major @Steam data breach occurred, compromising over 89 million user records (roughly two-thirds of all Steam accounts).

These datasets are being sold for over $5,000 on what appears to be a site akin to Mipped.

Mipped alongside their sister sites is a…
— Mellow_Online1 (@MellowOnline1) May 11, 2025

This Tweet was then followed with this:

Update: An update suggests that the alleged Steam data breach is not a direct breach of Steam itself, but rather a supply chain compromise — meaning an external service that Steam relies on was targeted.

Here's what we understand from this update:

New evidence confirms some…
— Mellow_Online1 (@MellowOnline1) May 11, 2025

So the net result is that 89 million Steam accounts are basically compromised. But the bad news doesn’t end there. The company that was pwned was Twillo. If that name sounds familiar, it is because that is the company behind the Authy authentication app. And that company was pwned last year with the details behind the app being kind of murky. None of this has been confirmed by Twillo. But it should not stop Steam users from dropping what they are doing and changing their passwords right now as well as being on the lookout for suspicious emails, phishing attacks and the like.

This entry was posted on May 13, 2025 at 11:32 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Steam Gets Pwned Via Third Party Service Getting Pwned”

Earth Ammit Targets Drone Supply Chain Says Trend Micro | The IT Nerd Says:
May 15, 2025 at 1:19 pm

[…] chain attacks are becoming increasingly pervasive. Just look at this high profile example from earlier this week. Thus organization’s defence strategy has to be based around this new […]

Loading...

Reply

The IT Nerd