Valve confirms the Steam leak is real, but denies suffering a breach

On May 13th, Steam users were faced with the news that a breach of some kind had affected gaming giant Valve, with a person going by the name of "Machine1337" selling a trove of data containing phone numbers, text metadata, and old Steam two-factor-authentication codes. While these codes were obviously long past their use-by date, it begged the question of who had suffered the breach. Initially, fingers were pointed at Twilio given their mention in the data, but Valve denied using Twilio's services, and Twilio denied suffering a breach. I reached out to Valve with a number of questions and received the following statement in response. In short, Valve confirms that the data is real, but denies suffering a breach of its own.