Steam breach: what really happened, and how to protect your Steam account
Breach / exposure. Updated 2026-09-13. About 6 minutes to read.
Turn on the Steam Guard Mobile Authenticator, only sign in on steampowered.com or steamcommunity.com, and never follow a stranger's link to a trade, giveaway or support chat.
In May 2025, posts claimed that data from 89 million Steam users was for sale. Valve disputed that Steam had been breached. It said the files were older text messages containing one-time codes that expired after 15 minutes, together with the phone numbers they were sent to, and that they did not link those numbers to Steam accounts, passwords or payment details.
That does not mean Steam accounts are safe by default. Valve has said that, at one point, around 77,000 accounts were hijacked every month, almost always through phishing, malware and reused passwords rather than a breach of Valve's systems. This guide separates the real incidents from the rumours, then walks through the settings and habits that actually protect a Steam account.
The May 2025 leak claim and Valve's response
The claim spread after a listing on a criminal marketplace offered what it described as Steam user data. Valve published a statement on Steam saying it was not a breach of Steam systems. According to Valve, the data consisted of older SMS messages with one-time codes valid for only 15 minutes and the phone numbers they were sent to, with no link to account names, passwords, payment information or other personal data.
Valve also pointed out that text messages are unencrypted in transit and pass through several providers on the way to your phone, which made the source hard to trace. It said users did not need to change their passwords, but recommended the Steam Guard Mobile Authenticator over SMS codes.
A leaked phone number can still attract scam texts, so be extra wary of any text that claims to be from Steam or Valve.
Security incidents at Valve that did happen
If you had a Dota 2 dev forum account or used Steam in 2011 with a password you still use elsewhere, change that password everywhere it was reused.
November 2011: Valve's Steam forums were defaced. Valve later told users an intruder had accessed a database containing encrypted passwords and payment card details, while saying it did not know whether the data had been taken or decrypted.
July 2016: Valve's official Dota 2 developer forum was breached, exposing almost 2 million accounts with email addresses, IP addresses, usernames and salted MD5 password hashes, according to Have I Been Pwned.
December 2015: Valve said it was seeing around 77,000 accounts hijacked and emptied of items each month. It responded with trade holds for accounts without the mobile authenticator, which still apply.
Check your Steam account now
Type store.steampowered.com into your browser and sign in. Do not use a link from a message.
Open Account details and check the email address and phone number are yours.
Open Authorized Devices at store.steampowered.com/account/authorizeddevices. If anything looks unfamiliar, choose to sign out everywhere.
Review your purchase history, your inventory history and any active Community Market listings for activity you did not make.
Check that Steam Guard is on and whether it uses email codes or the mobile authenticator.
Scan your computer for malware, especially if you have installed cheats, mods, cracked games or voice tools from outside official stores.
Run your Steam email address through the free email breach check and change any password that appears in a breach or is reused.
Steam Guard, trade holds and market holds explained
Steam Guard with email codes asks for a code sent to your inbox when you sign in from a new device. The Steam Guard Mobile Authenticator, inside the Steam Mobile App, is stronger: its codes change constantly and each one works only once, and the app can approve sign-ins by notification or by scanning a QR code on the sign-in screen. Valve does not accept new internet (VoIP) phone numbers for Steam accounts.
Trade and market holds exist to give you time to spot a hijacker. If your account has not had the mobile authenticator for at least the last 7 days, items leaving your account through trades or market listings are held by Steam for up to 15 days. If you cancel a held trade, Steam assumes you stopped a hijacker and applies a 7 day trading cooldown that Steam Support cannot remove.
Install the Steam Mobile App from the official app store and add the authenticator from the Steam Guard tab.
Write down the recovery code. In the app, you can find it again on the Steam Guard page under the gear icon, then Recovery Code.
Generate backup codes in Account details, Manage Steam Guard, Get Backup Codes, and print them rather than saving a screenshot.
Add a phone number to your account so you can recover it by SMS if you lose access.
Steam scams to recognise
Accidentally reported you: a friend or stranger says your account was reported by mistake and sends you to a support agent on Discord. Valve says this is always a scam, and Valve employees never contact you about your account through any chat system.
Fake trade and giveaway sites: pages that open a fake Steam sign-in window. Official Steam sign-in only happens on steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com.
Fake Steam Support alerts: malware can block your library and tell you to contact an agent. Any real Steam alert points only to help.steampowered.com.
Trade tricks: item switching, hidden items in large offers, requests to forward trade confirmation emails, fake payment for items, and verification or middleman trades.
Unexpected API keys: if a site asked you to register a Steam Web API key, or you find one you did not create, revoke it. Scammers with account access have used keys to watch and replace trade offers.
Once you confirm a trade, Steam cannot reverse it, and Steam Support does not restore items that leave an account for any reason. Check every item in an offer before you confirm it in the mobile app.
If your Steam account was hijacked
Secure the email account linked to Steam first: new password, two-factor authentication, and remove forwarding rules you did not set up.
Remove malware from your computer before changing the Steam password.
Go to help.steampowered.com and choose Help, I can't sign in, then follow the prompts. Search for your account using your own email address, even if the attacker changed it.
If self-recovery fails, open a ticket with Steam Support and provide proof of ownership: for a card purchase, the card type, the name and billing address on the card and the last four digits only. A photo of a retail product key with your ticket number written below it also works.
Once back in, change the password, add the mobile authenticator, sign out all other devices and check your friends list for messages the attacker sent.
Never pay anyone who claims they can recover the account or who is holding it for ransom. Valve says you can always recover the account through Steam Support.
Frequently asked questions
Was Steam hacked in 2025?
Valve says no. It stated the leaked data was a set of older SMS messages with expired one-time codes and phone numbers, not a breach of Steam systems, and that it did not include passwords, payment information or links to Steam accounts.
Do I need to change my Steam password?
Not because of the 2025 claim, according to Valve. Change it if the password is reused on another site, if your email address appears in a breach with that password, or if you see sign-ins or trades you did not make.
Why are my Steam trades on hold?
Items are held for up to 15 days when your account has not had the Steam Guard Mobile Authenticator for at least 7 days. Adding the authenticator does not shorten holds already in place, but trades made 7 days after you add it are not held.
Will Steam give me back items that were stolen or scammed?
No. Valve's item restoration policy says Steam Support does not restore items that have left an account, because restoring them would mean duplicating items or taking them from other users.
I lost my phone with the Steam authenticator. How do I get back in?
Use your recovery code or backup codes if you saved them. If you kept the same number on a new SIM, Steam can send you an SMS to move the authenticator. Otherwise, contact Steam Support through help.steampowered.com with proof of account ownership.