Path of Exile developer, Grinding Gear Games, has issued a sincere apology for a recent security breach stemming from a compromised test Steam account with administrator privileges. This article details the events and the steps taken to prevent future occurrences.

Over 66 Accounts Compromised

Enhanced Security Measures Promised

Grinding Gear Games' official PoE forum post, "Data Breach Notification," explains that a hacker compromised a Steam account with admin access, subsequently altering passwords on 66 Path of Exile 1 and 2 accounts. This was achieved using internal tools typically employed by customer support. The compromised admin account, created for testing purposes, lacked linked purchases, phone numbers, or addresses, allowing the attacker to deceive Steam support using minimal information (email address, account name) and a VPN to mask their location.

The hacker cleverly deleted password change notifications, concealing their actions from account owners. Access to sensitive data, including email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, transaction histories, and private messages, was gained. This information poses a significant risk to affected users.

Grinding Gear Games' statement concludes: "We have implemented enhanced security measures for admin accounts to prevent recurrence. Third-party account linking to staff accounts is prohibited, and significantly stricter IP restrictions are now in place. We deeply regret this security lapse. The necessary admin website security measures should have been implemented earlier, and we're committed to preventing similar incidents in the future."

Forum responses reflect player appreciation for the developer's transparency, while also urging the implementation of two-factor authentication (2FA) for enhanced security. While the timeline for 2FA implementation remains unclear, players are advised to change their passwords and remain vigilant about their account information.