Summary

• Path of Exile 2 developer Grinding Gear Games confirmed a data breach occurred during the week of January 6, 2025, due to a compromised developer's account linked to Steam.
• The breach exposed player email addresses, Steam IDs, IP addresses, and other sensitive information.

Grinding Gear Games has acknowledged a significant data breach in Path of Exile 2, resulting from a compromised developer's admin account. This account, linked to an old Steam testing account, allowed unauthorized access to the developer's tools typically used by the customer support team. Upon discovering the breach, the developers swiftly locked the compromised account and enforced password resets across all admin accounts. The investigation revealed that the breach enabled the attacker to access and manipulate other accounts through the developer portal.

Following the early access release of Path of Exile 2 in December 2024, the game has enjoyed a robust player base, bolstered by continuous updates and developer communication. Recent updates have enhanced performance on the PlayStation 5 and addressed issues with monsters, skills, and damage. As the next major patch approaches, Grinding Gear Games has taken the opportunity to address the data breach, ensuring players are informed before diving into the new content.

The official Path of Exile 2 forum was updated with a notice detailing the breach. The compromised account provided access to sensitive data, including email addresses, Steam IDs, IP addresses, shipping addresses, and unlock codes for a significant number of accounts. The attacker also managed to set random passwords on 66 accounts and exploit a bug to delete logs, though this bug has since been fixed. Importantly, no passwords or password hashes were accessible through the customer service portal. However, the attacker could potentially use email addresses to bypass region locking by comparing them against lists of compromised passwords from other sites.

In response to the breach, Grinding Gear Games has implemented stricter security measures, including prohibiting the linking of third-party accounts to staff accounts and enforcing more stringent IP restrictions. The community's reaction has been varied, with some commending the developers' transparency, while others demand the addition of two-factor authentication to enhance account security. Additionally, players are calling for further improvements in game content and adjustments to the endgame difficulty in Path of Exile 2.