Summary

• Path of Exile 2 developer Grinding Gear Games has confirmed a data breach that occurred during the week of January 6, 2025, caused by unauthorized access to a developer's account linked to Steam.
• The breach compromised player email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes.

Grinding Gear Games has acknowledged a significant data breach in Path of Exile 2, resulting from a compromised developer's admin account. This account, linked to an old Steam testing account, allowed the attacker to access sensitive tools typically used by the customer support team. In response, the developers swiftly locked the compromised account and enforced password resets across all admin accounts. The investigation revealed that the breach enabled the attacker to view and manipulate data for a substantial number of player accounts, including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes.

Following the early access release of Path of Exile 2 in December 2024, the game has continued to attract a robust player base, supported by regular updates and developer communication. Recent updates have enhanced performance on PlayStation 5 and addressed issues with monsters, skills, and damage. As the next major patch approaches, Grinding Gear Games has taken the opportunity to address the data breach, ensuring players are informed before diving into the new content.

The official Path of Exile 2 forum was updated with a notice detailing the breach. The attacker exploited a bug to delete logs and set random passwords on 66 accounts, although this bug has since been fixed. Importantly, no passwords or password hashes were accessible through the customer service portal. However, the attacker could potentially use compromised email addresses to bypass region locking on Steam-linked accounts. Some affected accounts also had their transaction and private message histories viewed.

To prevent future breaches, Grinding Gear Games has implemented stricter security measures, including prohibiting third-party account linking to staff accounts and enforcing more stringent IP restrictions. The community's reaction has been varied, with some commending the transparency of the developers, while others demand the addition of two-factor authentication to enhance account security. Additionally, players are calling for further improvements in game content and adjustments to the endgame difficulty in Path of Exile 2.