Yesterday, news broke about an alleged compromise of Steam, the major PC gaming platform. The data leak supposedly included information about 89 million Steam users.

Valve published a statement on the official website about the discovered data. Here is what the company revealed:

The details:

• The data consists of old SMS messages used for two-factor authentication.
• It includes one-time codes and the phone numbers the messages were sent to.
• Valve says that Steam was not breached.
• The investigation is ongoing.

Valve confirms that the "leaked data did not associate the phone numbers with a Steam account, password information, payment information or other personal data". Furthermore, the one-time codes are valid for 15 minutes only, which means that they have expired and can't be used for authentication anymore.

In other words: The data includes phone numbers of current or past Steam users and information that the accounts used SMS verification at one point in time for authentication.

No need to worry, says Valve

Valve says that Steam users do not need to change their passwords or phone numbers as a response to the data leak. It suggsts, however, that Steam users should be suspicious about any security message that they receive that was not triggered by the user's action.

Users may check their account security on Steam on the official website.

Switching authentication

Steam users are encouraged to switch to Steam Guard instead of using SMS and a mobile phone for verification. SMS is notoriosly unsafe, as messages are not encrypted. The same is true for email verifications, which are also unsafe.

Steam Guard is an authenticator for Steam. It is included in the official Steam apps for Anroid and iOS.

Here is how that is done:

1. Download the official Steam application for iOS or Android. The Steam Guard functionality is integrated into the app.
2. Sign in to the installed Steam app with your account credentials.
3. Steam Guard is displayed on one of the first pages after sign in.
4. Select "add authenticator" to start the setup process.
5. Valve sends a code to the phone number of the Steam account. If you have not added a phone number to the account, you are prompted to add one. You may also proceed without adding a phone number by selecting "I don't have access to a phone number".
6. Type the code to proceed.
7. Write down the recovery code that Steam displays on the next page. This code is needed to regain access to your account, if you do not have access to the device with the Steam mobile app (anymore).

Once set up, you have three options to sign in to Steam on another device:

1. Scan the Steam QR code using the mobile application.
2. Type the username and password to sign in and confirm the sign in using the mobile application.
3. Type the username and password, and then enter the Steam Guard code from the mobile app to sign-in.

Closing Words

Using two-factor authentication improves security significantly. This is true for any online service, but there are differences. Text or email codes are notoriously unsafe, while the use of authenticator apps is considered safer and better. You can check out our overview of the best authenticator apps for Android and iOS here.

Note that some proprietary services, including Steam, do not support third-party authenticators.

Now You: Do you use authenticator apps to protect online accounts? What about Steam? Do you use two-factor authentication here as well? Feel free to leave a comment down below.