Around 66 accounts in Path of Exile 2 were compromised, due to a one-two punch of an old unused Steam account and a backend bug

Path of Exile 2 early access class key art
(Image credit: Grinding Gear Games)

Path of Exile 2 has been carving out a lovely little niche for itself, based on how many hours of monster-smashing my colleagues here at PC Gamer have been pumping into it. But it hasn't come without its roadbumps—like, for example, a recent security breach that saw an estimated 66 (potentially more) accounts compromised.

That's as per a recent interview with streamers Darth Microtransaction and GhazzyTV. When asked whether there was data breach at Grinding Gear Games, game director Jonathan Rogers states that "there has been a situation where someone got access to an admin account," but that the full extent is yet to be seen.

"We now understand how that happened—we don't fully understand the scope of everything that occurred here, but we're sort of in the process of looking at logs, and so on … there were a few really shitty things that occurred here that I'm very unhappy about."

As Rogers puts it, the hacker in question managed to pry open access to the admin account through a bit of social engineering—which, when referring to cyber security, means the practice of sneakily getting secondary information via human interaction to achieve a hack, rather than hacking directly. The weak point in GGG's armour here was an old Steam account that the admin was no longer using, but that was nonetheless linked.

"[The person who] had it attached didn't really consider the fact that this old Steam account they weren't using anymore was attached to their admin account … that got compromised through Steam support." While Rogers doesn't know the exact details, he states that the hacker must've had some personal details such as credit card information.

Steam's "proof of ownership" page, for instance, will let you use a Visa credit card's name, billing address, and last four digits to reset a password to an account—all things a malicious actor could obtain via social engineering.

This was then made worse by a bug on GGG's end. When it came time to investigate, it was revealed that the studio's software was registering password resets for Path of Exile 2 accounts as "notes" rather than an "audit event", meaning that someone with admin permissions—the hacker, for instance—could go in and delete them, covering their tracks.

"It was really not obvious to us what was going on there. I don't have the full information yet about the extent of everything that happened, but what I can tell you is that 66 notes were deleted, so that would imply that 66 accounts were compromised," though Rogers notes they only have audit logs going back 30 days due to privacy regulations.

This meant that investigations into the issue—and whether it was a data breach or not—took a lot longer than they otherwise would have. "We initially had no idea, right, so we were like—ah shit, what the hell is going on here."

GGG is determined to patch up this vulnerability, though, as Rogers states: "Since then we've added a bunch of extra security stuff that, honestly, should've already been in place around this to sort this out, so, all of that is to say that we totally fucked up here, with security stuff on this account. We're certainly not gonna have any Steam accounts linked to [admins], we're gonna make sure there's no Steam accounts linked to customer service accounts any longer."

Obviously this kind of security breach is no joke—especially in an age where catastrophic data breaches seem downright commonplace (this is a reminder to go and change your old passwords). Still, studios are large and complex machines, and social engineering is downright hard to spot unless you're jumping at shadows. I hope GGG's able to close ranks around these weak spots soon.

Harvey Randall
Staff Writer

Harvey's history with games started when he first begged his parents for a World of Warcraft subscription aged 12, though he's since been cursed with Final Fantasy 14-brain and a huge crush on G'raha Tia. He made his start as a freelancer, writing for websites like Techradar, The Escapist, Dicebreaker, The Gamer, Into the Spine—and of course, PC Gamer. He'll sink his teeth into anything that looks interesting, though he has a soft spot for RPGs, soulslikes, roguelikes, deckbuilders, MMOs, and weird indie titles. He also plays a shelf load of TTRPGs in his offline time. Don't ask him what his favourite system is, he has too many.

Read more
A Path of Exile 2 sorceress casting flaming skulls in a hellish landscape
'We are incredibly sorry': Path of Exile 2 devs apologise for data breach that saw 66 accounts snatched and personal info potentially stolen
Path of Exile 2 showing the Warbringer ascendancy class bludgeoning his way through a pack of hyenas
'You deserve better customer service': Path of Exile 2 studio apologizes for long support wait times but with 545,000 emails received, it's kind of understandable
A Path of Exile 2 sorceress wearing robes and conjuring hourglasses with her hands on a purple and blue background
Path of Exile 2 players are finally getting into the game: 'What we are doing right now is letting in players in batches so that we can make sure to monitor the backend and not overload it'
A Path of Exile 2 sorceress casting flaming skulls in a hellish landscape
Path of Exile 2 may have sold too well, so beware queues: 'We really didn't expect to have more than a million people online at the same time'
Mister Fantastic giving a thumbs up
A Marvel Rivals player has uncovered 'one of the most dangerous vulnerabilities a game can have' that'll let cheaters take over your PC and find your passwords
Path of Exile 2 Sorceress build
Path of Exile 2's build-breaking patch leaves fans calling for better respec options
Latest in RPG
Dry Devil holds a torch and grins.
Kingdom Come 2 and Avowed have revealed to me the grand unified theory of game design: A good game is when you can steal back the money you just spent at a shop, a bad game is when you can't
Rue Valley key art
The creators of Disco Elysium unofficially consulted on fascinating upcoming RPG Rue Valley during a brutalist architectural tour of Belgrade: 'It was completely unexpected'
kingdom come: deliverance 2 sphere world
Kingdom Come: Deliverance 2 modder snaps, transforms all women, animals, and doors into fleshy spheres but turns all men invisible: 'It’s just spheres. Experience spheres!'
Gustave and Lune
Clair Obscur: Expedition 33 feels like a French Persona, with an impressive combat system that I should love, but which I actually hate
Male and Female Vault Dweller holding guns and cresting a hill with ruined city in background
The New Vegas remake of the Fallout 3 that never was just got its first demo, not to be confused with the straight-up remake of the cancelled Fallout 3 or, indeed, Fallout 3
Baldur's Gate 3 player character made to resemble Geralt of Rivia from The Witcher.
Wait a minute, Geralt of Rivia actor Doug Cockle was in Baldur's Gate 3 this whole time
Latest in News
Image of Tecumseh in Civilization 7
Civilization 7's 'first major update' tweaks balance and fixes some UI issues, but don't expect an overhaul
Jeff Jarrett headshot
Legendary 1990s publisher Acclaim is back from the dead, and a pro wrestler famous for clobbering people with a guitar is on its advisory board
Monster Hunter Wilds screen
Monster Hunter Wilds sells 8 million copies in 3 days, 'the fastest any game has done so in Capcom’s history'
Tony Hawk doing a kickflip or whatever the hell it is in the cover art for Tony Hawk's Pro Skater 3 + 4
Tony Hawk's Pro Skater 3 + 4 remake is real, and it's coming in July with new skaters, parks, music, and more
The streamer Emiru gives the peace sign to camera.
Three women livestreaming on Twitch harassed by man who then goes for them while making repeated death threats: 'This happens off-camera to women all the time'
Marvel's Avengers screen
Will another Avengers game be assembled? 'We would definitely be open to it' says Joe Russo, co-director of Avengers: Doomsday