Steam User Data Stolen in Partner Cyberattack

Steam is Valve Corporation's digital game distribution platform and storefront, launched in September 2003. The platform serves as the primary PC gaming marketplace, offering thousands of titles to millions of active users worldwide. A cyberattack on one of Valve's third-party partners has exposed Steam user personal information, according to a report from Rock Paper Shotgun. The attack compromises user privacy and creates a risk of fraudulent messages targeting Steam users.

Key Facts

The following table summarizes the essential facts of the Steam partner cyberattack as reported by Rock Paper Shotgun. Specific numbers of affected users have not been publicly disclosed.

The cyberattack on a Valve partner exposed Steam user personal information, with the primary risk being fraudulent messages sent to affected users.

What Happened in the Steam Partner Cyberattack?

A cyberattack targeting one of Valve's third-party partners resulted in the exposure of Steam user personal information, according to a report from Rock Paper Shotgun. The attack compromised partner infrastructure that handled Steam user data, leading to the potential exfiltration of personal details.

The report indicates that the breach was discovered after anomalous activity was detected on the partner's systems. The exact scope of the data exposure remains unclear, as Valve has not publicly disclosed the full extent of the compromise. Rock Paper Shotgun's reporting suggests that a "load" of Steam user personal information was affected, though specific numbers of impacted users have not been confirmed.

"Expect fake messages — a load of Steam user personal info has been [exposed] thanks to a cyberattack on one of Valve's partners," the Rock Paper Shotgun report warns.

— Rock Paper Shotgun

The exact number of Steam users affected by the partner cyberattack has not been publicly disclosed as of the report's publication.

What Steam User Data Was Exposed?

The Rock Paper Shotgun report indicates that Steam user personal information was exposed as a result of the cyberattack on Valve's partner. The specific data elements compromised have not been fully enumerated, but personal information typically includes usernames, email addresses, and potentially purchase history.

While the full scope of the data breach remains unknown, the report emphasizes that the exposure of personal information creates a significant risk of targeted phishing campaigns. Threat actors who obtained this data could use it to craft convincing fake messages that appear to come from legitimate Steam communications.

Steam user personal information, including potentially usernames and email addresses, was exposed in the partner cyberattack, though the complete data inventory has not been publicly confirmed.

How Can Steam Users Protect Themselves from Fake Messages?

Steam users should exercise heightened vigilance regarding unsolicited messages following the partner cyberattack. The primary protective measures include verifying message authenticity, avoiding clicking links in suspicious communications, and enabling Steam Guard two-factor authentication.

Users should be particularly cautious of messages that request account credentials, payment information, or prompt urgent action. Legitimate Steam communications will never ask for passwords or sensitive financial details. Users can verify the authenticity of any Steam-related communication by navigating directly to the Steam platform rather than following links embedded in messages.

Enabling Steam Guard two-factor authentication and verifying message authenticity through direct platform navigation are the primary protective measures against post-breach phishing attempts.

Who Is This For?

This information is critical for all active Steam users, particularly those who have made purchases or shared personal information through the platform. The cyberattack on Valve's partner potentially affects any user whose data was processed by the compromised partner system.

Users who have been active on Steam for extended periods, have linked payment methods, or have engaged in marketplace transactions face the highest risk of targeted phishing attempts. The report's warning about fake messages applies broadly to the entire Steam user base, as the full scope of affected users has not been delineated.

All active Steam users should consider themselves potentially affected by the partner cyberattack, as the full scope of the data exposure has not been publicly delineated.

Common Questions

Steam users have three primary concerns following the partner cyberattack: whether fake messages are expected, how to respond to suspicious communications, and whether Valve has confirmed the breach's full scope.

Should I expect fake messages on Steam after this cyberattack?

Yes. The Rock Paper Shotgun report explicitly warns users to expect fake messages following the cyberattack on Valve's partner. Threat actors who obtained Steam user personal information may use it to craft convincing phishing messages designed to steal credentials or spread malware.

What should I do if I receive a suspicious message on Steam?

Do not click links or download attachments from suspicious messages. Verify the sender's identity through official Steam channels, and report any suspicious messages to Valve. Enable Steam Guard two-factor authentication if you have not already done so.

Has Valve confirmed the full extent of the data breach?

As of the Rock Paper Shotgun report's publication, Valve had not publicly confirmed the full extent of the data exposure. The report indicates that a "load" of Steam user personal information was affected, but specific numbers of impacted users and the complete data inventory remain undisclosed.

Steam users should expect fake messages following the partner cyberattack, and the three most common questions concern message authenticity, protective actions, and the scope of the data exposure.

Sources and Methodology

This article is based on the Rock Paper Shotgun report titled "Expect fake messages — a load of Steam user personal info has been [exposed] thanks to a cyberattack on one of Valve's partners," published at rockpapershotgun.com. The original report was written in English and has been preserved without translation.

This article synthesizes information from the single primary source listed above. Where specific statistics or data points are not available in the source material, this article explicitly notes that the information is unknown rather than speculating.

This article was last updated on February 2025.

This article is based exclusively on the Rock Paper Shotgun report about the Steam partner cyberattack, and no additional external sources were synthesized.