Path of Exile Data Breach Confirmed

Path of Exile 2 Developer, Grinding Gear Games, Addresses Data Breach

Grinding Gear Games publicly acknowledged a data breach affecting Path of Exile 2 that occurred during the week of January 6th, 2025. The breach stemmed from a compromised developer account linked to Steam. This unauthorized access exposed sensitive player data, including email addresses, Steam IDs, IP addresses, and other information.

The breach exploited a developer's admin account, granting the attacker access to tools normally used by Path of Exile 2's customer support team. Following the discovery, the compromised account was immediately locked, and all other admin accounts underwent mandatory password resets. Investigations revealed the compromised account was linked to an old, inactive Steam account used for testing purposes. While this Steam account contained no personal or financial data, its connection to the developer's Path of Exile 2 account provided the attacker with access to the developer portal.

A significant number of accounts were impacted, with compromised data potentially including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. While passwords themselves were not directly accessible, the attacker may have used compromised email addresses to attempt password resets or bypass regional restrictions on Steam-linked accounts. In some cases, transaction and private message histories were also viewed.

To enhance security, Grinding Gear Games has implemented several measures, including the removal of third-party account linking for staff accounts and significantly stricter IP restrictions. The developer's response has been met with a mixed reaction from the community, with some praising their transparency while others advocate for the implementation of two-factor authentication. The incident underscores the ongoing need for robust security measures in online gaming.