Path of Exile 2 Developer Addresses Major Data Breach

Grinding Gear Games, the developer behind Path of Exile, issued a public apology following a significant data breach earlier this month. The breach stemmed from a compromised Steam test account possessing administrator privileges. This incident resulted in unauthorized password resets for over 66 Path of Exile accounts.

Enhanced Security Measures Implemented

The breach involved a long-standing test account lacking crucial security features like linked phone numbers or addresses. This vulnerability allowed an attacker to successfully impersonate the account holder to Steam support, gaining access using minimal information (email address, account name, and a VPN masking their location).

The attacker further concealed their actions by deleting password change notifications. Access to sensitive data, including email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, transaction histories, and private messages, was gained. Grinding Gear Games acknowledges the potential misuse of this stolen information.

In response, the developers have implemented stricter security protocols for administrator accounts, including eliminating third-party account linking and imposing more stringent IP restrictions. They expressed deep regret for the security lapse and committed to preventing future occurrences.

The community responded with a mix of understanding and concern. While many appreciated the developer's transparency, calls for two-factor authentication (2FA) were prevalent. While the implementation of 2FA remains pending, players are advised to change their passwords and remain vigilant about their account security.