Data Breach Confirmed for Path of Exile 2

Summary

Grinding Gear Games, the developer of Path of Exile 2, has confirmed a data breach that occurred during the week of January 6, 2025. The breach was initiated when a user gained access to a developer's account linked to Steam, compromising various player details such as email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes.

The breach was traced back to a compromised admin account used by a developer, which was linked to an old Steam account for testing purposes. This unauthorized access allowed the attacker to utilize customer support tools, impacting a significant number of accounts. In response, Grinding Gear Games swiftly locked the compromised account and enforced password resets across all admin accounts. They also discovered and fixed a bug that had allowed the attacker to delete logs, which could have obscured the breach's impact.

The attacker was able to set random passwords for 66 accounts and access sensitive data, including transaction and private message histories. Although no passwords or password hashes were directly compromised, there was a risk of the attacker using email addresses to match against lists of compromised passwords from other sites, potentially bypassing region locks on Steam accounts linked to Path of Exile 2.

To prevent future breaches, Grinding Gear Games has implemented stricter security measures, including the prohibition of linking third-party accounts to staff accounts and enhanced IP restrictions. The community has responded with mixed feelings, appreciating the transparency but also demanding improvements like two-factor authentication, enhanced in-game content, and adjustments to endgame difficulty.

Following the early access release of Path of Exile 2 in December 2024, the game has maintained a robust player base, supported by regular updates. The most recent update improved performance on the PlayStation 5 and addressed issues with monsters, skills, and damage. The next major patch is expected soon, and the developers have addressed the data breach before its release to ensure players are informed as they return to the game.