It's Time for Real Change

Over the past few days, there has been significant discourse surrounding reports I put out of an alleged Steam data breach involving over 89 million records, and I want to take this opportunity to offer full transparency, clarify the timeline of events, and provide some closing thoughts.

On May 11th, a member of the Sentinels of the Store Discord community shared a LinkedIn post from a cybersecurity-focused account, Underdark.AI, reporting a claim that a threat actor named "Machine1337" was selling an alleged database of Steam user data on a dark web forum. The post included details such as them having over 89 million Steam user records & links to a sample dataset

Given the seriousness of the claim and the potential risk to users, I echoed the warning on Twitter/X to advise Steam users to take basic account security measures (enable 2FA, change passwords, stay vigilant). I cited the original source - Underdark.AI - and linked to their post directly.

40 minutes after I made the initial post, I was made privy to an update Underdark issued stating that they had suspected a Twilio-related vendor compromise, rather than the information coming from a direct Steam breach. After I was made aware of this, I updated my X thread clarifying that this incident appeared to be a supply chain compromise - not a direct breach of Steam’s systems.

While I made my initial posts on May 11th, my posts didn't start to get traction until May 14th following what was at first a couple of media outlets picking up the story, however this then quickly snowballed to over 100 outlets covering it including larger sites such as Gaming Bible, Rock Paper Shotgun, VG 24/7, and Bleeping Computer amongst others as well as some tech and gaming YouTubers, many typically citing me as the origin source. These outlets had picked the story up after I'd already issued an update emphasising this was not a Steam Breach - but a suspected supply chain compromise, however many outlets still ran with the Steam Breach headline.

As the story got more traction, I was then emailed by a Steam engineer, both asking for support discovering the source of the leak, but who also stated definitively that Steam does not use Twilio, casting doubt on the earlier claim that the sample data came via that route. I immediately updated my posts with this new clarification and ensured anyone who had quoted or referenced the original thread was made aware.

Importantly, I did not originate the breach claims, nor did I ever claim to possess the leaked data. My intention was to amplify an already-public report and encourage vigilance while more information came to light.

Valve has now released its own statement regarding the matter. The leaked sample appears to include older SMS-based 2FA messages. No Steam systems were breached, and the data does not include any user credentials or sensitive account information (excepting phone numbers, but these just got leaked in an isoalted format, there's no way to match up the Steam account with the phone number.) The messages cannot be used to compromise Steam accounts, and no password or payment data was exposed.

Their full post is available here.

While I acted in good faith and with caution, I recognise that the situation caused concern and some confusion. My intention was never to sensationalise or mislead, but to inform and protect users based on publicly available reports.

To those who felt misled - I hear you, and I apologise if my posts contributed to any undue alarm. I hope this full accounting helps demonstrate that my aim was to act transparently and responsibly at every stage.

This will be my final statement on the matter. I remain committed to consumer protection and transparency in the gaming space through Sentinels of the Store - and I’ll continue working constructively, not combatively, with platforms like Steam to do so.

Thank you to everyone who constructively engaged, questioned, and helped clarify things along the way.

Stay safe,
Mellow