The Path of Exile 2 team at Grinding Gear Games (GGG) explained how a compromised Steam account led to multiple players of the Early Access action-RPG (ARPG) losing their entire inventories full of gear.
Apparently, a "hacker" (more likely it was a case of social engineering) was able to get into an administrative account on the Path of Exile website. This allowed the person to reset passwords on dozens of accounts. From there, the hacker was able to gain access to these accounts and thus grant them access to the powerful gear those players have spent countless hours grinding for. The gear was then traded to other accounts or sold and the traded currencies then transferred to the hacker's main account(s).
Podcasters GhazzyTV and Darth Microtransaction recently spoke with Path of Exile 2 game director Jonathan Rogers. During the podcast, Rogers flatly admits that they "totally fucked up here" when it comes to this recent "hack."
Rogers says that this entire situation began with a compromised Steam account. The Steam account was linked to an admin account on the Path of Exile 2 website. Once the hacker had access to the site's admin account, they were able to reset user passwords and then log into the game as those players.
Making the situation worse is an apparent bug in GGG's internal systems. Rogers says that the hacker basically "had access to (...) the same stuff that customer service had access to." However, a bug in their system resulted in the password changes being listed as an inconsequential "note" and not as an "event" which would have been later audited by others. Because of this, the "note" saying that the password was changed by the hacker was also easily deleted by the same hacker. This allowed the hacker to cover their tracks and make it less obvious to GGG that something was going on.
Rogers says that they found 66 notes deleted. He suggests that this would imply that 66 accounts were compromised. It could be more than 66 accounts though as Rogers says they only keep their logs for 30 days.
The hacker actually gained access to the Steam account and website admin account before Path of Exile 2 launched into Early Access this past December. This means that the hacker was quietly biding his time and waiting for players to amass a considerable amount of loot before enacting their plan to empty the inventories.
Rogers says that they have since added in additional security measures that "honestly should have already been in place." They are also ensuring that there will no longer be any Steam accounts linked to any admin or customer service accounts in order to prevent this from happening again in the future.
