Loading story…
A reportedly unauthenticated public endpoint tied to Valve's legacy Steam2 infrastructure exposed an estimated 12–13 TB of game-content data dating from 2003 to 2013. The archive reportedly contains internal development materials and historical third-party releases, including early builds or assets for Portal 2, Left 4 Dead, Counter-Strike: Global Offensive, the abandoned F-Stop Portal concept, and a “Weaponizer” asset linked to the canceled Half-Life 2: Episode Three.
Reports characterize the incident as a legacy-infrastructure access-control misconfiguration, not a compromise involving stolen credentials or an authentication bypass; no current customer or operational data has been reported in the archive. Valve had not publicly confirmed ownership or authenticity of the dataset, explained the endpoint's exposure, or validated claims regarding additional unreleased Half-Life material. If confirmed, the exposure underscores the need to inventory retired systems, enforce authentication, continuously review internet-facing assets, and securely archive or dispose of legacy data.
Map this exposure pattern across your cloud, code, and identities.
10 events from the most recent confirmed update back to the earliest known activity.
Data miners examining the reported Steam2 Teraleak cache said it included possible weapon assets from the cancelled Half-Life 2: Episode Three. The archive's source and claims that it was obtained through a public endpoint rather than hacking remained unverified.
Reports published across August 29–30 alleged that an unauthenticated public endpoint exposed or enabled extraction of approximately 12–13 TB of Valve Steam2-era content from 2003–2013. The reported material includes internal development assets and third-party releases; Valve had not publicly confirmed the archive's origin or acknowledged the exposure.
Valve transitioned major Source-engine game distribution from Steam2-era NCF/GCF packaging toward SteamPipe and VPK-based packaging.
Valve released Portal 2 after abandoning the earlier camera-oriented F-Stop direction and returning to portal-based gameplay.
The reported archive includes 2011 prototype builds combining Source physics and movement with early Left 4 Dead 2 engine code and early Counter-Strike: Global Offensive interface elements.
The archive reportedly includes a playable reconstructed Portal 2 beta dated July 2009, reflecting the scrapped Core Hub concept and retaining material associated with F-Stop.
The reported archive contains an early Left 4 Dead build dated June 2008, with a different HUD, unused voice lines, altered map areas, and unfinished assets.
Valve launched the Steam platform, whose early Steam2-era distribution infrastructure later generated the archived content reportedly exposed.
Dataminers examining the reported archive identified multiple playable Portal 2 prerelease builds, along with cut dialogue, alternate scenes, and discarded mechanics including adhesion gel and a slow-motion function.
Data miners reportedly identified beta or prototype material for third-party games including Spore, Dragon Age: Origins, Batman: Arkham Asylum, Sonic the Hedgehog 4, and Spec Ops: The Line in the alleged Steam2-era archive. The reported inclusion of unreleased development builds raised intellectual-property and piracy concerns for affected publishers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
6 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcearstechnica.com
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourcetomshardware.com
Open sourcethecybersecguru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner **CEVA Logistics**. The company said attackers had access to CEVA servers between **July 29 and August 1, 2026**, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers. Valve said the breach was limited to fulfillment data held by CEVA and did **not** expose Steam account credentials, payment card information, or **Steam Guard** codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Aug 16, 2026
Atlas Menu, a cheat service for **Grand Theft Auto V** and **Counter-Strike 2**, suffered a breach in May that exposed data tied to roughly **64,000 accounts**. Multiple reports said an attacker claimed to have compromised all Atlas systems and then published the stolen database in a public GitHub repository. The leaked records reportedly included email addresses, usernames, IP addresses, support tickets, and passwords stored as **`bcrypt` hashes**; other reporting said the dump also contained license keys, signup dates, Rockstar Games account identifiers, banned-user lists, and administrator logs. Atlas Menu’s site later went offline, and no clear intrusion method or official company explanation had been disclosed. The attacker allegedly described the intrusion as retaliation against a scammer, while breach-tracking service **Have I Been Pwned** added the incident to its database and UpGuard assessed it as a medium-severity exposure. Although the passwords were hashed, the combination of account data, IP addresses, and support history raises risks of credential stuffing, phishing, social engineering, and doxing, particularly for users who reused passwords or tied their real identities to the service. The breach also drew attention to allegations that Atlas software could capture screenshots while running, adding to concerns about the sensitivity of the exposed user base.
Jun 29, 2026
Security researchers at Flare have discovered that over 10,000 public Docker Hub container images are leaking sensitive secrets, including live credentials for production systems, cloud services, CI/CD pipelines, and AI platforms. The exposed data affects more than 100 organizations, ranging from small businesses to a Fortune 500 company and a major national bank. Many of these secrets are not placeholders but active credentials, with nearly 4,000 API keys for large language models such as OpenAI, HuggingFace, Anthropic, Gemini, and Groq found in the wild. In some cases, a single image contained five or more exposed secrets, significantly increasing the risk of unauthorized access to critical infrastructure. The leaks are often the result of developers inadvertently including sensitive files and hard-coded keys in Docker images, which are then published to public repositories. A notable portion of the exposed secrets comes from "shadow IT" accounts—personal or team Docker Hub registries outside formal corporate oversight—making them difficult for organizations to monitor and secure. The majority of affected organizations are in the software development sector, but the exposure also impacts finance, banking, and AI companies. This incident highlights the urgent need for improved security hygiene and automated scanning in the container development lifecycle to prevent inadvertent credential leaks.
Jun 29, 2026