Path of Exile 2 Apologizes for Major Data Breach

Path of Exile developer, Grinding Gear Games, has issued a sincere apology for a significant data breach stemming from a compromised test Steam account with administrator privileges. This article details the events and the steps taken to prevent future incidents.

Over 66 Accounts Compromised

Enhanced Security Measures Promised

Grinding Gear Games recently addressed a data breach on the official Path of Exile (PoE) forums. Their statement, titled "Data Breach Notification," explained that a hacker compromised a Steam account with administrative access to PoE. This allowed the attacker to reset passwords on 66 PoE 1 and PoE 2 accounts, leveraging tools typically used by customer support agents. The compromised admin account, created for testing purposes, lacked linked purchases, phone numbers, or addresses, making it vulnerable to social engineering. The attacker successfully impersonated the account owner using minimal information (email address, account name) and a VPN to mask their location.

Further, the hacker cleverly deleted password change notifications, concealing their actions from account holders. Access to sensitive data, including email addresses, Steam IDs, IP addresses, shipping addresses, unlock codes, transaction histories, and private messages, was gained. This compromised information poses a significant risk to affected users, potentially jeopardizing their other online accounts.

Grinding Gear Games stated, "We have taken steps to significantly enhance the security surrounding admin accounts to prevent recurrence. Third-party account linking to staff accounts is prohibited, and we've implemented far stricter IP restrictions. We deeply regret this security lapse. The necessary measures to secure the admin website should have been in place, and we're committed to implementing even more robust security protocols to prevent similar issues in the future."

Community response to the announcement has been mixed, with some praising the developer's transparency while others urge the implementation of two-factor authentication (2FA) for enhanced security. While the timeline for 2FA implementation remains unclear, players are advised to change their passwords and remain vigilant about their account information.