Path of Exile 2 Confirms Data Breach

Path of Exile 2 Developer Acknowledges Data Breach Affecting Player Information

Grinding Gear Games, the developer behind Path of Exile 2, has disclosed a data breach that occurred during the week of January 6, 2025. The breach stemmed from a compromised developer account linked to Steam.

Compromised Data: A significant number of player accounts were affected. The compromised information includes email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. While passwords and password hashes were not directly accessible, the potential for using compromised email addresses to guess passwords from other breaches remains a concern. In some cases, transaction and private message histories were also viewed.

Breach Details: The breach originated from a developer's compromised admin account, granting unauthorized access to tools used by the Path of Exile 2 customer support team. The attacker exploited a now-patched bug to delete logs, hindering the investigation. The compromised Steam account, used for testing purposes, lacked personal financial information but provided access to the developer's Path of Exile account, enabling the attacker to access the developer portal.

Security Enhancements: In response, Grinding Gear Games has implemented several security measures. These include disabling the linking of third-party accounts to staff accounts and enforcing significantly stricter IP restrictions.

Community Reaction: Player reactions have been varied. While some appreciate the developer's transparency, many advocate for the implementation of two-factor authentication for enhanced account security. Concerns regarding overall account security and in-game content updates, including endgame difficulty adjustments, have also been raised.

The developers are actively working to improve security protocols to prevent future incidents. The incident highlights the importance of robust security measures in online gaming environments.