Path of Exile 2 Developer Addresses Significant Data Breach

Grinding Gear Games, the developer behind Path of Exile, has issued a public apology following a data breach impacting over 66 accounts. The breach stemmed from a compromised test Steam account with administrative privileges. This article details the incident and the subsequent security measures implemented by the developers.

The Breach: A Compromised Admin Account

The breach originated from a long-standing test Steam account used internally by Grinding Gear Games. Lacking crucial security features like linked phone numbers or addresses, this account was vulnerable to exploitation. A hacker successfully impersonated the account owner using minimal information (email address, account name, and a strategically used VPN) to gain access from Steam support.

The hacker leveraged the account's administrative access to reset passwords on 66 Path of Exile accounts (both PoE 1 and PoE 2). They cleverly deleted password change notifications, concealing their actions from affected users. The compromised data included sensitive personal information such as email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, transaction histories, and private messages. This raises serious concerns about potential misuse of this information.

Grinding Gear Games' Response and Enhanced Security

Grinding Gear Games acknowledges their responsibility and has taken steps to bolster security. The company states that they've implemented stricter measures around admin accounts, prohibiting third-party account links and significantly enhancing IP restrictions. They express deep regret for the security lapse.

Community Reaction and Future Steps

The community response has been mixed, with some praising the developer's transparency while others advocate for the immediate implementation of two-factor authentication (2FA) to prevent future breaches. While the specifics of future security enhancements remain unclear, players are urged to change their passwords and remain vigilant about their account security. The addition of 2FA is highly anticipated.