Path of Exile 2 Confirms Data Breach

Path of Exile 2 Developer, Grinding Gear Games, Addresses Data Breach

Grinding Gear Games recently disclosed a data breach affecting Path of Exile 2 players. The breach, discovered the week of January 6, 2025, stemmed from a compromised developer account linked to Steam. This unauthorized access granted the perpetrator access to sensitive player data.

Compromised Information:

A significant number of accounts were affected, with the compromised data including email addresses, Steam IDs, IP addresses, and in some cases, shipping addresses and unlock codes. While passwords and password hashes were not directly accessible, the potential for the attacker to utilize compromised email addresses against known password lists to circumvent regional account restrictions exists. Some accounts also experienced exposure of transaction and private message histories.

The Breach and Response:

The breach originated from a developer's admin account, providing access to tools used by Path of Exile 2's customer support team. Grinding Gear Games immediately responded by locking the compromised account, initiating password resets for all admin accounts, and launching a thorough investigation. The investigation revealed the compromised account was linked to an old, inactive Steam account used for testing purposes. A bug allowing the deletion of relevant logs was also discovered and subsequently patched.

Security Enhancements:

To prevent future incidents, Grinding Gear Games has implemented several security improvements. These include the prohibition of linking third-party accounts to staff accounts and the introduction of significantly stricter IP restrictions.

Community Reaction:

Player reaction has been varied. While some commend the developer's transparency, others advocate for the implementation of two-factor authentication for enhanced account security. There are also calls for broader security improvements and adjustments to in-game content and endgame difficulty.

The incident serves as a reminder of the importance of robust security measures in online gaming. Grinding Gear Games' prompt response and subsequent security enhancements demonstrate a commitment to protecting player data.