Steam Hit With Data Breach Affecting 89 Million Users – And Steam Deck Users Are Doubly Vulnerable

There’s some bad news for Steam users, that may be more complicated than it was in the last few decades.

As reported by VG 24/7, Valve has apparently fallen to a security breach. A hacker called Machine1337 claims that they picked up 89 million Steam user records in a dark web forum. Machine1337 says this is a ‘fresh’ leak, and it goes beyond more than passwords. It’s possible that the compromised information includes two-factor SMS logs, message contents, metadata, delivery status and other details.

VG 24/7 recommends that Steam users make changes to secure their accounts now, and of course, it’s the most obvious thing to immediately change your password. But we don’t agree with their advice to follow Steam guidelines to enable two form factor authentication, at least now without careful planning. As explained in this ComputerWeekly article, two form factor authentication is now known to also be a vulnerable and easy to hack security system. No less than former Twitter CEO Jack Dorsey got his account hacked this way.

Does this mean we should drop two form factor authentication completely? Not necessarily. But it’s worth considering that this data breach could have happened precisely because someone’s two form factor authentication was compromised. On an individual level, you should mitigate whatever risks one could open up if you decide to go for this system. That could mean setting up a secondary device for authentication that isn’t used by other people, and/or doesn’t leave your vicinity, or your personal room, as much as possible.

It’s been a while since Valve’s systems have been hacked, and there’s a new complication to this news that didn’t exist before. We know there are roughly 4 million Steam Deck PC gaming handhelds that have been sold so far. And Steam Decks create new opportunities for vulnerabilities, and new needs for security measures.

Now, under SteamOS, Steam Deck consoles have all the security measures that you can use with the desktop version of Steam. On top of that, there is an internal PIN system specific to each device. You can choose between three PIN options. However, because the Steam Deck does not have a fingerprint sensor or a built in camera, you can’t log on using those systems. In contrast, Windows Hello or Apple’s Touch ID and Face ID systems exist for Windows and Mac/iOS users.

But it goes further than that, because Valve has not yet gotten around to adding drive encryption to the Steam Deck. As a result, the internal SSDs in the Steam Deck, even the ones that came with the Deck when you buy it, is vulnerable to hackers. In fact, it’s not impossible that Machine1337 pulled an SSD from a Steam Deck, possibly from someone who works in Valve or a game developer who publishes games on Steam. They then looked into the SSD’s data and found the system vulnerability that they then used to access and compromise Steam.

If you’re a Steam Deck user, you may want to ask help to encrypt its internal drive. It’s not impossible, but this is the kind of specialized knowledge that you may be better off paying someone to do for you. But really, aside from changing your password, we think it’s best if you removed your payment information from your Steam account now, at least until Valve addresses this issue. We really hope they can get to this sooner rather than later.