Path of Exile 2 Developer Acknowledges Data Breach Following Staff Account Compromise

Grinding Gear Games, the developer behind Path of Exile 2, has confirmed a data breach impacting a significant number of player accounts. The breach, discovered the week of January 6, 2025, stemmed from a compromised developer account linked to Steam.

Compromised Information: The breach exposed sensitive player data, including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. While passwords and password hashes were not directly accessible via the compromised portal, Grinding Gear Games acknowledges the potential for the attacker to utilize compromised email addresses and publicly available password lists to circumvent region locks on Steam-linked accounts. In some cases, transaction and private message histories were also viewed.

The Breach's Origin: An attacker gained access to a developer's admin account, exploiting a now-patched vulnerability that allowed log deletion. This access granted the attacker the ability to view player information through the developer portal. Sixty-six accounts had their passwords arbitrarily changed by the attacker.

Grinding Gear Games' Response: The developer immediately took action, locking the compromised account and mandating password resets for all admin accounts. A subsequent investigation revealed the compromised account was linked to an old, inactive Steam account used for testing purposes. To prevent future incidents, the company has implemented stricter IP restrictions and prohibited linking third-party accounts to staff accounts.

Community Reaction: Player response has been varied. While some commend Grinding Gear Games' transparency, others advocate for the implementation of two-factor authentication for enhanced account security. The incident highlights ongoing player concerns regarding security measures and desired improvements to in-game content and endgame difficulty.

Summary of Key Points:

• Date of Discovery: Week of January 6, 2025.
• Cause: Compromised developer account linked to Steam.
• Data Compromised: Email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, and (in some cases) transaction and private message histories.
• Grinding Gear Games' Actions: Account lockdown, password resets, enhanced security measures (stricter IP restrictions, prohibition of third-party account linking to staff accounts), and bug fixes.