Path of Exile 2 Developer Confirms Data Breach: Player Information Compromised

Grinding Gear Games, the developer behind Path of Exile 2, has confirmed a data breach affecting a significant number of player accounts. The breach, discovered the week of January 6th, 2025, stemmed from a compromised developer account linked to Steam.

Compromised Information: The breach exposed sensitive player data, including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. While passwords and password hashes were not directly accessible, the risk of credential stuffing remains a concern. In some cases, transaction and private message histories were also viewed.

Root Cause: The breach originated from a compromised developer account used for testing purposes. This account, linked to an old, inactive Steam account, provided the attacker with sufficient access to infiltrate the developer portal. A subsequent bug allowed the deletion of logs tracking unauthorized changes, further hindering the investigation. This bug has since been patched.

Developer Response: Grinding Gear Games immediately took action, locking the compromised account and initiating password resets for all admin accounts. They are implementing enhanced security measures, including stricter IP restrictions and the prohibition of linking third-party accounts to staff accounts.

Community Reaction: The community response has been varied. While some players appreciate the developer's transparency, many are demanding improved security features, such as two-factor authentication, and further enhancements to game security and endgame content.

Impact: The breach highlights the vulnerability of even established games to sophisticated attacks. The incident underscores the importance of robust security practices and the ongoing need for developers to prioritize player data protection. Grinding Gear Games' proactive response, while appreciated, underscores the need for continuous security improvements and a commitment to player safety. The long-term effects of this breach on player trust and the game's reputation remain to be seen.