Earlier today, headlines claimed “89 million Steam accounts” were compromised via a Twilio based SMS leak, and panic set in. But Steam itself has spoken: no breach of Steam systems ever occurred. Let’s break down what really happened, why the story spread so fast, and what (if anything) you need to do.
The Rumor That Spread Too Fast
- A dark?web seller claimed 89?million old SMS 2FA codes and phone numbers were leaked.
- Multiple gaming news sites, eager to be first, reposted it as fact without waiting for Valve’s confirmation.
- The core misconception: that Steam uses Twilio for 2FA and that old codes could be used to hijack accounts.
Steam’s Official Statement
A note about the security of your Steam account
The recent leak being reported did NOT breach Steam systems.
You may have seen reports of leaks of older text messages that had previously been sent to Steam customers. We have examined the leak sample and have determined this was NOT a breach of Steam systems.
We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone.
The leak consisted of older text messages that included one time codes that were only valid for 15 minute time frames and the phone numbers they were sent to. The leaked data did not associate phone numbers with a Steam account, password information, payment information, or other personal data.Old text messages cannot be used to breach the security of your Steam account. Whenever a code is used to change your Steam email or password using SMS, you will receive a confirmation via email and or Steam secure messages.
You do not need to change your passwords or phone numbers as a result of this event. It is a good reminder to treat any account security messages that you have not explicitly requested as suspicious.
We recommend regularly checking your Steam account security at any time at https://store.steampowered.com/account/authorizeddevices.
We also recommend setting up the Steam Mobile Authenticator if you haven’t already, as it gives us the best way to send secure messages about your account and your account’s safety.
Why the Hoax Looked Plausible
- SMS in Transit Is Unencrypted: Old text messages can be intercepted through rogue carriers or databases. This has nothing to do with Valve’s servers.
- 15 minute code window. Even if someone obtained an old 2FA code, it expired long ago and was never tied to passwords or payment data.
- Mix and match reporting. Some outlets conflated leaked SMS messages with a Steam account breach, creating a frightening but incorrect narrative.
What You Should Actually Do
- Ignore Old SMS Alerts: If you get unexpected 2FA codes, don’t click any links.
- Enable Steam Mobile Authenticator: It’s more secure than SMS.
- Review Authorized Devices: Visit
store.steampowered.com/account/authorizeddevicesto revoke any unknown sessions. - Use Unique, Strong Passwords: A password manager is your friend.
Holding the Media Accountable
By rushing to publish, some outlets sacrificed accuracy for clicks and misled readers. At KonNetwork, we wait for confirmation from the source before sounding the alarm. That is how you know you can trust our coverage.
Conclusion & Call to Action
Don’t let clickbait scare you into needless password changes. Steam’s own words say it best: “You do not need to change your passwords or phone numbers as a result of this event.” Bookmark this post for real time debunking, and let us know in the comments what rumors you want us to break down next.
