Grinding Gear Games, the developers behind Path of Exile (PoE), have issued a heartfelt apology following a significant security breach that affected their community. The incident, which was detailed in a post on the official PoE forums titled "Data Breach Notification," sheds light on the vulnerability and the subsequent actions taken to bolster security.

Over 66 Accounts Compromised

Developers Promise Better Security Measures

The breach stemmed from a compromised Steam account with administrative privileges, originally created for testing purposes. This account, lacking any linked purchases, phone numbers, or addresses, was exploited by a hacker who managed to deceive Steam's customer support into granting access using minimal information such as the email address, account name, and a VPN to mimic the account's country of origin.

The hacker utilized the compromised account to alter passwords on 66 different PoE 1 and PoE 2 accounts, employing tools typically used by customer support. They further obscured their actions by deleting password change notifications, preventing account owners from being alerted. This breach allowed access to sensitive personal data including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. Additionally, the hacker viewed transaction histories and private messages, potentially setting the stage for further malicious activities.

"We have taken steps to ensure that there are more security measures around admin accounts so that this can not happen again. No 3rd party accounts are allowed to be linked to any staff accounts and we have added significantly more stringent IP restrictions. We are incredibly sorry for this lapse in security. The measures taken to secure the admin website really should have already been in place and in the future we will be taking even more steps to make sure that this kind of issue never occurs again," the developers stated in their apology.

The community's response on the forum was mixed, with some players appreciating the transparency of Grinding Gear Games, while others called for the implementation of two-factor authentication (2FA) to enhance account security. As the developers work on reinforcing their security protocols, PoE players are advised to change their passwords and remain vigilant about their account information. The addition of 2FA could be a crucial step in preventing future breaches, and it is hoped that Grinding Gear Games will prioritize this enhancement.