Path of Exile 2 Developer Addresses Major Data Breach

Grinding Gear Games, the developer behind Path of Exile, has issued a public apology following a significant data breach earlier this month. The breach resulted from a compromised Steam test account with administrative privileges. Over 66 accounts were affected.

The Breach: How it Happened

The breach stemmed from a long-standing test account lacking robust security measures. Crucially, this account lacked linked phone numbers, addresses, or purchase history, making it vulnerable to social engineering. A hacker successfully impersonated the account holder to Steam support, gaining access using minimal information (email address, account name, and a VPN to mask location).

The attacker exploited the compromised account's administrative access to reset passwords on 66 Path of Exile 1 and 2 accounts. They cleverly deleted password change notifications, concealing their actions from affected users. The breach exposed sensitive data, including email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, transaction histories, and private messages.

Response and Future Security Measures

Grinding Gear Games acknowledges the severity of the breach and the resulting compromise of user data. They've pledged to enhance security protocols surrounding administrative accounts, including stricter IP restrictions and prohibiting the linking of third-party accounts to staff accounts.

The community response has been mixed, with some praising the developer's transparency while others advocate for the immediate implementation of two-factor authentication (2FA). While 2FA is not yet confirmed, players are urged to change their passwords and remain vigilant regarding their account security. The incident serves as a stark reminder of the importance of robust security practices for both developers and players.