My Dog vs. Elite Lawyers, Part 4: Dr. Patrick, Your Own Document Just Destroyed Your Client.

Parts 1–3 established the breach: Taylor Wessing sent 830 pages of fake-redacted Steam user data to the subject of their own legal threat (black rectangles over fully readable text). Pfizer, SAP, Chubb's Cyber Incident Response Team: the same Aspose.PDF 20.8 pipeline. Dr. Patrick Zurheide then GDPR-erased his own name from Google and called a data breach notification involving children "amusing." The dog is 3–0.

• My Dog vs. Elite GDPR Lawyers: The Valve Data Breach Nobody is Talking About
• My Dog vs. Elite Lawyers (Part 2): The 5-Year PDF Vulnerability Exposing Global Corporations
• My Dog vs. Elite Lawyers 3: Valve, GDPR, and the Cover-Up

Now Dr. Patrick has produced his star witness. It is himself.

🚨 Key Findings

Valve maintains a field called "Suspected Hijacker." It is a native category in Valve's own data export. The export was produced under legal compulsion, signed by Dr. Patrick Zurheide under qualified electronic signature, and filed through the German judicial beA system. On the account covered by this disclosure, the field is populated 312 times.

Valve told victims for seven years it could not identify attackers. The same legal correspondence describes Valve tracking a device that simultaneously logged into dozens of stolen Steam accounts across multiple years. The support script and the legal letter cannot both be true. Taylor Wessing chose to file both.

Web sessions never expired, by design. Attackers read private messages, regenerated API keys, and substituted trade offers indefinitely, because Valve set web session lifetime to "never." Valve expires gameplay sessions routinely. It chose not to expire the sessions controlling users' tradable assets.

The stolen items are still there, still hidden. When Valve bans a bot account, stolen items are frozen and the inventory concealed from public view. Not one item has ever been returned to any victim. Valve keeps them.

The attack ran from 2018 to July 2025, seven years and four months. Of five interventions, four failed.

Some rows in the 830-page document were correctly redacted. Others were not. The document proves that Taylor Wessing can redact a PDF. What remained readable was not selected by accident.

The Field Names Sent To The Subject Of Their Own Legal Threat

The Article 15 data export, produced by Valve under legal compulsion and transmitted by Taylor Wessing to the subject of the GDPR request, contains these native field names from Valve's own systems:

"Suspected Hijacker" is a field Valve named, maintains, and populates. It is not an inference, and it is not something we are reading into the data. It was transmitted under a legal obligation of accuracy and completeness, over a qualified electronic signature.

Valve has had a "Suspected Hijacker" classification throughout the entire period during which victims were told:

"We cannot identify suspicious activity on your account."

The field was there, it was populated, and the capability existed. The choice was made not to use it to protect users, only to ban accounts and freeze their contents.

The Sentence That Ends The Argument

Dr. Patrick Zurheide, Taylor Wessing Hamburg, 1 October 2025. Signed and filed through beA:

"Over a period of several years, between 2019 and 2023, this user account was used principally from a device which at the same time was also used to log in to dozens of stolen Steam user accounts."

To produce that sentence, Valve must:

• Record a persistent hardware identifier per session
• Retain it across multiple years
• Cluster unrelated accounts by shared device identifier across the entire platform
• Identify which of those accounts were stolen
• Perform the analysis retrospectively, on demand, years after the events

That is precisely the capability whose absence has been the stated reason for refusing restitution to every victim who ever contacted Steam Support.

Dr. Patrick's own filing proves it exists and has existed throughout.

For seven years, Steam Support told victims: "We cannot determine who operated your account."

For seven years, Valve was clustering accounts by device identifier, populating a "Suspected Hijacker" field, and logging every session with hardware fingerprint, IP address, and exact timestamp.

Both positions cannot be true.

Either Valve can attribute sessions to devices and cluster accounts, in which case restitution was refused while Valve held data identifying the actor.

Or it cannot, in which case its ban decisions are unsupported by the evidence it claims to hold.

Dr. Patrick, which is it? You filed proof of both.

What Valve's Systems Actually Collect

These are the actual fields confirmed by the document itself rather than by a privacy policy:

Per session logged: Exact login and logoff timestamp. IP address with city, region, and country. Session type (Steam Client or Web/Mobile). Hardware device fingerprint.

Per account: Creation timestamp. Last login. Last logoff. Total spend in USD. Email address. Country. Full display name history with timestamps of every change.

Per complaint received: Reporter identifier. Timestamp. Category. Full text of the complaint.

Cross-account: Device clustering across the entire platform. One device touching dozens of unrelated accounts is logged, retained, and queryable on demand, years later.

This is the system whose outsourced support staff (including teams in Russia with access to private message history, authentication records, and session durations) type the following into your ticket before closing it:

"Technical limitations prevent us from verifying what occurred."

The Web Session Never Expired, and That Was a Choice

Valve expires gameplay sessions routinely. A concurrent login, a network change, or a change in client state terminates the session.

The web session, which controlled the user's entire tradable inventory, private messages, and API credentials, had no expiry. An attacker who obtained it retained it indefinitely. They could:

• Read the account holder's private messages in real time, in parallel with the owner
• Generate and regenerate Web API keys automatically; deleting the key failed because the live session recreated it instantly
• Monitor all trades, chats, and activity continuously
• Cancel legitimate trade offers and substitute fraudulent ones
• Accept terms of service in the user's name, which created the "authorisation" Valve cited against the victim in every refused claim

The "Type" field in Valve's own export records whether each session was a Steam Client or Web/Mobile session. The attack operated exclusively through web sessions. Valve recorded this attribute for every single session throughout the entire period. It is the exact attribute that separates the attack path from ordinary use.

Web/Mobile sessions show HardwareID 0, which means no hardware fingerprint is bound. Every web session capable of executing this attack is, by construction, a session Valve knows is not tied to a verified device.

That is a detection signal. It existed in Valve's own session table on every occasion for seven years, and it went unused.

Five Interventions in Seven Years: Only the Last One Worked

Late 2018 to early 2019
Added account age and level indicators to the mobile trade confirmation screen.
→ The attack continued.

May 2022
Removed cancel and decline trade endpoints from the public Web API.
→ Operators moved to web session hijacking via stolen browser cookies. The attack continued and intensified.

3 December 2023
Required mobile authentication to generate a Web API key.
→ No effect. The attack ran on keys already issued and sessions already hijacked. After this fix, a single advertising campaign by scam operators netted an estimated USD 300,000 in a few days.

2 October 2024
Seven-day hold on re-trading items received in a trade.
→ Operators waited seven days.

16 July 2025
Trade Protection ships. The sender can reverse a completed trade within seven days, unilaterally.
→ The offer-substitution mechanism ceased to be viable.

The fifth intervention worked, which proves it was always possible. Valve had the capability; it applied a control it already possessed to a problem it had already identified.

The interval between knowing how to stop it and stopping it is seven years and four months. During that entire interval, victims were told the losses were their own fault.

The Items Are Still There and Still Hidden

When Valve bans a bot account, it freezes the stolen items on it. The inventory is concealed from public view. Neither the victim nor any researcher can see what is held there.

The items are not returned or transferred to any authority. They remain on accounts Valve itself adjudicated as fraudulent, under Valve's exclusive control, indefinitely.

Valve's stated justification references item duplication concerns from 2014. Every tradable item carries a unique asset identifier. Restoration is a reassignment of an existing database record, not creation of a new item. Duplication is not a risk inherent in restoration.

The seven-day trade hold Valve itself introduced means every transferred item sits stationary, identified, and attributable for a week after every theft. The evidentiary chain for restoration exists in Valve's live systems, in real time. By banning the receiving account, Valve had already determined that the transfer was fraudulent. It then withheld the consequence of its own finding.

No other custodial platform retains property it has adjudicated as stolen, conceals its location, and characterises this as an anti-fraud measure.

A bank does not keep the proceeds of a fraudulent transfer.
A payment processor does not keep a reversed payment.

Valve does.

Page 8. The Sentence That Belongs In A Museum.

Dr. Patrick Zurheide, same document, same signature, same date:

"Eine genauere Auskunft ist aufgrund des Schutzes der personenbezogenen Daten anderer Nutzer der Steam-Plattform nicht möglich."

"More detailed disclosure is not possible in order to protect the personal data of other Steam users."

This sentence appears in the same document transmitted with 830 pages of those users' personal data (readable under black vector shapes) to the subject of Taylor Wessing's own criminal prosecution threat.

The complaint section of that document contains personal identifiers, contact details, and links to private personal files belonging to the Steam users who filed reports against this account. Some of those users are children. Steam operates no effective age verification, and children use the platform. Their data enters Valve's systems, is accessed by outsourced support teams in multiple countries, and was transmitted by Taylor Wessing, in a selectively fake-redacted PDF, to a party described in the same letter as an active criminal threat.

No breach notification was filed, no user was informed, and no regulator was contacted by Taylor Wessing.

Dr. Patrick's response when notified of the breach: "Amusing."

He is the partner on Chubb's Cyber Incident Response Team.

The Dog Never Betrays. Taylor Wessing Apparently Did.

We want to say something we cannot prove. But equally, no one can disprove it.

Some rows in the 830-page document were correctly processed. In those rows the text was deleted rather than covered, and it is actually gone. That is how a competent data protection practice at a firm of Taylor Wessing's billing rates would handle a legally sensitive disclosure.

Taylor Wessing can redact a PDF. The document proves it.

That means what remained readable was not the product of a uniform technical failure. A broken tool fails everywhere. This did not fail everywhere. Specific sections were left fully readable: the sections containing the "Suspected Hijacker" field, the complaint data with children's information, and the session records that directly contradict Valve's victim-support position. Other sections were not.

Incompetence does not select. Incompetence fails uniformly.

We are left with a question we cannot answer and cannot avoid:

Did someone at Taylor Wessing decide to leave it readable?

We will not assert it as fact. We observe that the alternative (a selective failure that, by coincidence, exposed exactly the data that demolishes Valve's legal position while protecting data that does not) requires an improbable coincidence to sustain.

Consider what Taylor Wessing was being paid to defend: seven years of platform-enabled theft, 312 "Suspected Hijacker" entries on a single account, session data proving Valve watched it happen and did not act, and children's complaint data flowing through outsourced support operations in Russia. Stolen items were frozen on banned accounts, the inventories were hidden, nothing was returned, and victims were told it was their own fault.

Perhaps someone reached a limit.

The dog has never betrayed anyone. The dog has never transmitted children's personal data to a hostile party. The dog has never selectively failed to redact the sections that expose her employer's client to regulatory consequence.

Taylor Wessing sent the file to the subject of their own legal threat, with some rows correctly deleted and others left exactly as they were.

Draw your own conclusion. We drew ours.

🐾 Good Boy, Dr. Patrick.

You threatened a GDPR requester with criminal prosecution inside the response document itself. You cited user data protection in a file leaking user data. You called a breach notification "amusing." You GDPR-erased your own name from Google as if that would help.

And then you sent 830 pages containing a field called "Suspected Hijacker" (populated 312 times) to the person asking the questions.

Every regulator now has that sentence. Every journalist has that field name. Every affected user has the toolkit to open their own Taylor Wessing documents and check what is underneath the black rectangles.

You did more for this investigation than we ever could have done alone.

Good boy.

The dog approves.

October 14.

Part 2 of our full investigation publishes October 14.

IPFS valve.xmr|steamdestroy.eth

Since we know the "doctors" believe the right to be forgotten applies in their case, we think hosting on IPFS is a great test of how skilled they really are (or, obviously, how much they aren't). You have an infinite amount of time, exactly as long as the valve.xmr domain remains registered, because in Part 2, I will demonstrate and prove that Valve skins are faster and more reliable than anonymous cryptocurrency.

We won't say more. We don't need to.

The Regulatory Record

The complaint is filed. The documents are on record, with the field names in them and the signatures on them.

The authorities that matter have the referral under reference PD-VALVE-2026/01. We give notice of its existence. We give notice of nothing else.

Part 5 comes when they answer.

The dog is waiting.

— PhishDestroy Research Team (and the Dog)

Part 1 https://phishdestroy.io/valve-profits-from-stolen-accounts

IPFS CID: bafybeiawlyqj267cdywzzmfpdqar5n6umhheijqebwqiz2xifa3pgbmupm

Full investigation and evidence: phishdestroy.io
Toolkit: github.com/phishdestroy/taylor-wessing-data-breach-toolkit
Reports: complains@phishdestroy.io