Steam has had a few genuine data breaches and security incidents since 2011, plus a couple of scares that turned out smaller than the first headlines. By Valve's account, none handed anyone a readable password, though a 2015 bug let strangers take over accounts without Steam Guard for four days. Here is what each exposed, what Valve advised and what to check next time.
Steam breaches and leaks at a glance
| When | What was exposed | Passwords |
|---|---|---|
| Nov 2011 | A database of names, emails, purchases, billing and encrypted card data | Hashed and salted |
| Jul 2015 | Accounts without Steam Guard, via a broken password reset | Changed, never revealed |
| Dec 2015 | About 34,000 users' Store pages, possibly shown to others | Not included |
| May 2025 | Old SMS codes and phone numbers, billed as 89 million records | Not included |
| Aug 2026 | Feared: European delivery details; later said to be unaffected | Partner had none |
2011: a forum hack that reached a Steam database
Steam's forums were defaced on November 6, 2011, and Valve found the intruders had also reached a Steam database. It held user names, purchases, email and billing addresses, encrypted card details and hashed, salted passwords. Hashing turns a password into a one-way scramble, and salting adds random data to each one so identical passwords don't produce identical hashes.
Gabe Newell's message to every user said Valve had no evidence card numbers or personal details were taken, or that the protection on cards or passwords was cracked. Forum users had to pick new passwords and were told to change the old one anywhere they had reused it. Steam passwords weren't forced to change, though Newell said doing so "wouldn't be a bad idea".
In February 2012 he wrote that the intruders had probably copied a backup of Steam transactions from 2004 to 2008: names, emails and encrypted billing and card details, but no Steam passwords. His advice was to watch card statements and keep Steam Guard on.
July 2015: a password reset that skipped the code
Steam's account recovery emails a code you need before setting a new password. From July 21 to July 25, 2015, attackers could skip that step by leaving the code box empty, so knowing an account's name was enough to take it over. SecurityWeek noted numerous reports of hijacked accounts, including from prominent players.
Valve fixed the bug and reset the passwords changed through account recovery in that period, emailing owners a new one. It said the bug never revealed anyone's password, and that accounts with Steam Guard enabled couldn't be hijacked this way.
Christmas 2015: other people's account pages
On Christmas morning 2015, a denial-of-service (DoS) attack flooded the Steam Store with traffic 2,000% above the Steam Sale average. Valve's web caching partner, which serves stored copies of pages to spare Steam's servers, managed the caching rules used to cope. A second configuration wrongly cached pages for signed-in users, so some people saw pages generated for someone else.
Between 11:50 and 13:20 Pacific time, about 34,000 users' pages may have been seen by others. Depending on the page, they could show a billing address, the last four digits of the Steam Guard phone number, purchase history, the last two digits of a card number or an email address. They didn't include full card numbers, passwords or enough to log in or buy as that user. Valve took the Store offline until the cached copies were purged and said no action was needed.
May 2025: the Steam leak of old text messages
In May 2025 a seller offered what were billed as 89 million Steam user records for $5,000. BleepingComputer examined a sample and found old Steam text messages with one-time codes and the phone numbers they went to.
Valve's May 14 Steam News post said this was not a breach of Steam systems. The codes had been valid for only 15 minutes, the data didn't link the numbers to any Steam account, password or payment details, and old messages can't be used to break into an account.
Valve was still tracing the source, which it said was harder because text messages travel unencrypted through several providers. Nobody needed to change a password or phone number, it said.
August 2026: a hack at Valve's shipping partner
On August 10, 2026, Valve emailed people who had recently ordered Steam hardware in Europe. Attackers had hit CEVA Logistics, which ships that hardware, between July 29 and August 1, and CEVA said the attackers likely took the delivery details it held: name, postal address, phone number, the Steam account's email address, and the type and price of the product. CEVA keeps them for up to 90 days after an order.
Valve said CEVA had no access to payment details, passwords or Steam Guard codes, and that no password change was needed. The risk was phishing: fake emails, texts or calls posing as Steam or a delivery company, which might quote your address and ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in to "verify" the order. Valve's instruction: "Treat all of them as fake."
A follow-up email, reported on September 16, said the attack was limited to part of CEVA's systems and the one handling Steam hardware orders wasn't affected, with no indication customer data had been accessible to the attacker. CEVA's investigation hadn't concluded at that point.
What a leak means for your account
Hashed passwords can still be cracked by guessing: attackers hash likely candidates, including passwords leaked from other sites, and look for matches. If a password you use on Steam ever leaks anywhere, change it everywhere you used it.
Leaked contact details are a different risk: a message that quotes your real address looks genuine, which is the trick Valve warned about in 2026. Fake sign-in pages and malware need no breach at all, and the guides to spotting phishing sites and malware in Steam games show how they work.
Was Steam hacked? Checking the next breach claim
Valve has answered every incident above itself, so look for its own statement before trusting a screenshot or headline. Then:
- Type Steam's address yourself. Valve's 2026 email said every real Steam login page is on
store.steampowered.com,www.steampowered.com,steamcommunity.comorhelp.steampowered.com. - Keep Support on its own site. Steam Support handles account problems only at
help.steampowered.com, never by email, Steam Chat or Discord, and never asks for your password or a Steam Guard code. - Check Authorized Devices. Valve recommends reviewing that page in your account regularly, not only after a scare.
- Use the Mobile Authenticator. Valve called it its best way to send you secure messages, and the Steam Guard guide covers how it differs from email codes.
- Read confirmations. Valve says any SMS code used to change your Steam email or password triggers a confirmation by email or Steam secure message. If one arrives for a change you didn't make, work through the account security checklist at once.
Sources
- Message from Gabe to Steam Community, November 2011 — Steam News
- Message from Gabe to Steam Community, February 2012 — Steam News
- Vulnerability Allowed Hackers to Hijack Steam Accounts — SecurityWeek
- Update on Christmas Issues — Steam News
- A note about the security of your Steam account — Steam News
- Valve responds to Steam leak rumors: 'this was not a breach of Steam systems' — The Verge
- Valve emailed about a cyberattack against their shipping partner CEVA Logistics in Europe — GamingOnLinux
- Valve now say your data is safe from the CEVA Logistics cyberattack — GamingOnLinux
