Summary

• Path of Exile 2 developer Grinding Gear Games has confirmed a data breach occurred during the week of January 6, 2025, caused by unauthorized access to a developer's account linked to Steam.
• The breach compromised player data including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes.

Grinding Gear Games, the developer behind Path of Exile 2, has acknowledged a significant data breach affecting the game. The breach stemmed from a compromised admin account belonging to one of their developers, which was linked to an old Steam account used for testing purposes. This vulnerability allowed the attacker to access sensitive tools typically used by the customer support team.

Upon discovering the breach, Grinding Gear Games swiftly locked the compromised account and enforced password resets across all admin accounts. Their investigation revealed that the attacker had access to a range of player data, including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes. Additionally, the attacker was able to alter passwords for 66 accounts and exploit a now-fixed bug to delete logs of these changes.

Despite the severity of the breach, no passwords or password hashes were accessible through the customer service portal. However, the attacker could potentially bypass region locking by comparing compromised email addresses against lists of compromised passwords from other sites. Some affected accounts also had their transaction and private message histories viewed by the attacker.

In response to the breach, Grinding Gear Games has implemented stricter security measures. They have severed the link between third-party accounts and staff accounts and introduced significantly more stringent IP restrictions. These actions aim to prevent future breaches and enhance overall security.

Since its early access launch in December 2024, Path of Exile 2 has enjoyed a robust player base, bolstered by regular updates and open communication from the developers. A recent update enhanced the game's performance on PlayStation 5 and addressed several gameplay issues. The next major patch is eagerly anticipated by the community.

The community's reaction to the data breach has been varied. While some players appreciate the transparency from Grinding Gear Games, others are advocating for the implementation of two-factor authentication for Path of Exile 2 accounts. There is also a call for improvements in security, in-game content, and adjustments to the endgame difficulty.

Grinding Gear Games remains committed to enhancing the security of their admin accounts and ensuring the safety of their players as they continue to support and develop Path of Exile 2.