"Path of Exile 2 Data Breach Confirmed"

Summary

• Path of Exile 2 developer Grinding Gear Games confirmed a data breach occurred during the week of January 6, 2025, due to a compromised developer's account linked to Steam.
• The breach exposed player email addresses, Steam IDs, IP addresses, and other sensitive information.

Grinding Gear Games has acknowledged a data breach in Path of Exile 2, resulting from a compromised developer's admin account. The breach was traced back to an old Steam account used for testing, which inadvertently provided access to the developer's Path of Exile account. In response, the developers have taken immediate action by locking the affected account and enforcing password resets across all admin accounts. They are also implementing enhanced security measures to prevent future incidents in both Path of Exile 2 and its predecessor, which share a common login system.

Since its early access launch in December 2024, Path of Exile 2 has enjoyed a robust player base, bolstered by continuous updates and developer engagement. A recent update enhanced the game's performance on PlayStation 5 and addressed issues related to monsters, skills, and damage. With the next major patch on the horizon, Grinding Gear Games addressed the data breach to reassure players before they dive into the new content.

The official Path of Exile 2 forum was updated with a notice detailing the breach. The compromised account had admin access to the website, typically used by the customer support team. The breach allowed the attacker to manipulate 66 accounts by setting random passwords and deleting logs due to a bug, which has since been fixed. The compromised data included email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. Although passwords and password hashes were not directly accessible, the attacker could potentially use the email addresses to bypass region locking on Steam-linked accounts. Additionally, some account transaction and private message histories were viewed.

To mitigate future risks, Grinding Gear Games has severed the link between third-party accounts and staff accounts and introduced stricter IP restrictions. The community's reaction has been varied, with some commending the transparency of the developers, while others demand the implementation of two-factor authentication for Path of Exile 2 accounts. There is also a call for further security enhancements, alongside improvements to in-game content and adjustments to the game's endgame difficulty.