Steam Data Breach: 89 Million Accounts Exposed?

No, there has been no confirmed data breach of Steam exposing 89 million accounts. The figure stems from a 2021 incident involving a third-party gaming platform, not Steam itself, and Steam’s official databases have not been compromised in any publicly confirmed breach. This article explains where the number came from, how Steam’s security actually works, and what you should do to protect your account.

Where Did the 89 Million Number Come From?

The “89 million accounts� figure traces back to a July 2021 report about a breach of Genshin Impact’s publisher, miHoYo (now HoYoverse). A hacker claimed to have accessed a database containing 89 million user records from miHoYo’s systems, not from Steam. The confusion likely arose because Genshin Impact is distributed through Steam, and some users linked their Steam accounts to the game. However, the breached data was from miHoYo’s own servers, not Steam’s. Steam’s parent company, Valve, has never confirmed any breach of its user database, and no credible evidence has surfaced to suggest one.

Steam’s Security Architecture

Steam uses a combination of measures to protect user accounts:

• Encrypted passwords: Passwords are hashed and salted, meaning they are stored as irreversible cryptographic hashes, not plain text.
• Steam Guard: A two-factor authentication (2FA) system that requires a code from the Steam mobile app or email to log in from a new device.
• Device confirmation: New logins require confirmation via the Steam app, adding another layer of protection.
• Regular security audits: Valve conducts internal security reviews, though details are not public.

These systems are designed to make it difficult for attackers to use stolen credentials, even if they were obtained from another site.

Common Misconceptions About Steam Breaches

Several rumors circulate about Steam data breaches, often based on misunderstandings:

• “Steam was hacked in 2015â€� – In 2015, Steam had a denial-of-service (DDoS) attack that disrupted service, but no user data was stolen.
• “Steam accounts are sold on the dark webâ€� – While some Steam accounts are sold, these usually come from phishing or credential stuffing (using passwords leaked from other sites), not a breach of Steam’s database.
• “Steam has been breached multiple timesâ€� – Valve has not disclosed any breach of its user database. The only confirmed incident was in 2004, when an early version of Steam was compromised, but that predates the modern platform.

Always verify claims with official Valve announcements or reputable tech news sources.

How to Protect Your Steam Account

Even without a breach, your account can be at risk if you reuse passwords or fall for phishing. Follow these steps:

1. Enable Steam Guard – Go to Steam > Settings > Account > Manage Steam Guard, and choose the mobile authenticator option.
2. Use a unique password – Create a strong password that you don’t use anywhere else. Consider a password manager.
3. Be wary of phishing – Never enter your Steam credentials on a site that isn’t steampowered.com or steamcommunity.com. Check the URL carefully.
4. Check your account activity – Review recent logins under Account Details > Recent Login History.
5. Revoke unused API keys – If you use Steam Web API, check for any suspicious keys under your account settings.

What to Do If Your Account Is Compromised

If you notice unauthorized activity, act quickly:

1. Change your password immediately.
2. Deauthorize all devices via Steam > Settings > Account > Manage Steam Guard > Deauthorize all devices.
3. Contact Steam Support through the official help site to recover your account.
4. If you used the same password elsewhere, change it there too.

Steam Support can help restore access if you provide proof of ownership, such as a CD key or purchase receipt.

Steam’s Response to Security Incidents

Valve has a history of responding to security issues with patches and public announcements. For example, in 2019, a vulnerability in the Steam client that could allow remote code execution was patched quickly after being reported. In 2021, Valve fixed a bug in the Steam chat system that could expose IP addresses. These incidents were not data breaches but highlight Valve’s active monitoring. When a real breach occurs, Valve typically notifies users via email and posts a notice on the Steam news hub.

Frequently Asked Questions

Has Steam ever been hacked?

Steam has not suffered a confirmed data breach of its user database. The 2004 incident involved a compromised server that exposed some user information, but modern Steam has not disclosed a similar event.

Is the 89 million number real?

Yes, the number is real, but it refers to a 2021 breach of miHoYo’s database, not Steam. The data included usernames, emails, and hashed passwords from Genshin Impact players, not Steam credentials.

Should I change my Steam password?

It’s always a good idea to use a unique password and enable Steam Guard. If you used the same password on other sites, change it. If you haven’t changed it in a while, do so now.

Can Steam Guard be bypassed?

Steam Guard can be bypassed if an attacker has access to your email or mobile device. That’s why it’s important to secure your email with its own 2FA and never share your mobile codes.

Does Steam sell my data?

Steam’s privacy policy states that it does not sell personal data. It uses data to provide services, and you can control some sharing through your privacy settings.

Related

• 1049 1428 Steam Machines: Worth It as a Console?
• Summer Camp Tech Essentials: Top Picks
• EU’s Once-Only Principle: What It Means