The Steam Illusion: How Valve Operates a Shadow Economy, Enables Data Theft, and Ignores International Law

An Exclusive Investigative Report by Our Team

Our project did not come into existence because times were good. Our existence is not a testament to Steam’s success, but a critical necessity born out of Valve’s absolute disregard for user security. In fact, our fight against phishing directly interfered with Valve’s business model, disrupting their carefully crafted economy of account bans and item resales. (We will release a separate, detailed piece exposing the company's true "values" and their parody of cybersecurity at a later date).

For over a decade, Valve Corporation has hidden behind a curated, consumer-friendly facade. But beneath the surface lies a cynical corporate machine. Through an extensive internal investigation, our team has deconstructed the policies that Valve prefers to keep quiet. This is the anatomy of a platform that acts as an unregulated financial syndicate, appeases sanctioned states, shelters compromised outsourced support, and treats European laws as optional suggestions.

1. The Sanctions Farce and Pro-Russian Bias

For Valve, users in the EU and the US are nothing more than cash cows. While European gamers pay full price, Steam continues to provide aggressive discounts of 70% to 80% for the Russian market. A game in Russia costs a fraction of what it costs in Germany. This is what international "sanctions" look like in Valve's dictionary.

The platform does everything to appease and popularize this vector: they facilitate region swapping, turn a blind eye to money laundering via in-game items, and explicitly state in their Terms of Service that they submit to the jurisdiction of any Russian court. It reaches the point of absurdity: on the rare occasions when Steam servers experience massive outages, the first entity to officially comment on the technical failures is often Roskomnadzor (the Russian federal censorship agency).

2. The Outsourced Support Cartel

The myth of a "strict, secure American technical support" collapses the moment you realize who holds the keys to Steam’s backend. Valve has delegated support in the CIS region to a deeply compromised, corrupt outsourced network staffed by Russian contractors who actively abuse their access privileges to rob users.

We have successfully deanonymized segments of this network. A key figure managing or curating this support branch is an individual named Nikita. Our investigation revealed that this individual (or at the very least, his primary email) is registered and active as a user on underground hacking forums like Lolzteam (Zelenka)—a notorious darknet hub entirely dedicated to the sale of stolen credit cards, compromised databases, and brute-force logs.

This outsourced Russian support cartel has repeatedly stolen or handed over private user details to fourth-party scammers in order to brute-force accounts, reset credentials, restore access to dormant profiles, and hijack valuable digital inventories for underground market profit. Valve is fully aware of this systemic corruption and has previously acknowledged precedents where outsourced staff systematically drained high-value user inventories. Yet, maintaining this cheap, unaccountable, and corrupt outsourced workforce is far more profitable to Valve than hiring qualified, in-house cybersecurity professionals. To Gabe Newell, your security and digital property are minor costs compared to the savings gained by outsourcing backend access to bad actors.

3. Scamming as a Business Model and Offshore Currency

Steam’s in-game skins have become a ubiquitous, untraceable currency across the darknet—a financial laundromat that bypasses international regulators and tax authorities.

To Valve’s financial department, scammers are not a threat; they are external agents stimulating market velocity. The traditional model of "one user, one game" brings in limited revenue. However, a compromised ecosystem creates a highly profitable loop: a user is hacked, the items are stolen, the scammer's accounts receive a "Trade Ban," and the victim is forced to create a new profile and rebuy their assets.

When Valve bans a scammer, they do not return the stolen assets to the rightful owner. They freeze them permanently, effectively hoarding stolen goods inside their own ecosystem. This creates artificial scarcity. Decreasing the market supply drives up the prices of the remaining items, which in turn multiplies Valve’s 15% commission on the Community Market. To keep this highly lucrative operation quiet, since 2024 Valve has actively sent legal threats and cease-and-desist letters to third-party databases and inventory-tracking websites. By forcing these tracking platforms to stop listing banned inventories, Valve successfully conceals the exact statistics and multi-billion-dollar valuation of the frozen assets they profit from, ensuring the public remains blind to the scale of their hoarded loot.

4. The CEVA Logistics Breach: Undeniable Proof of Negligence

If you believe Valve at least protects your physical, real-world data, the recent incident regarding CEVA Logistics proves otherwise. Between July 29 and August 1, 2026, hackers breached Valve's European hardware logistics partner. Valve only acknowledged the breach on August 7, leaving users' data in the hands of malicious actors for a week.

The leaked data includes real names, full residential addresses, phone numbers, and Steam-linked email addresses of European customers who ordered physical hardware. Valve tries to pacify users by stating that "passwords and payment data" were not leaked. But a Full Name, Home Address, Phone Number, and Steam Email is the exact blueprint required for devastatingly effective spear-phishing and account hijacking—a goldmine for the very outsourced staff and scam networks mentioned above. Valve essentially handed your data to them.

5. Call to Action: The European Stand Against Corporate Immunity

Every gamer in Europe needs to wake up to a harsh reality: you are paying 5 times more for games than users in Russia, yet your European rights and laws (GDPR) are completely silenced. Your personal data leaks to third-party contractors, and your support tickets are handled by a CIS outsource network with a highly questionable reputation.

We send our fiercest, most sarcastic greeting to the highly paid corporate lawyers at Taylor Wessing, who defend Valve’s lawless monopoly. Their technical incompetence is a public hazard. In a documented GDPR case, when Valve was forced to release personal data logs, these expensive attorneys redacted the documents by simply slapping a black overlay on the PDF. Underneath that easily removable black box sat fully visible, unencrypted personal data, including sensitive information of EU and Russian minors. Instead of warning the victims, Valve and Taylor Wessing quietly covered up the breach, leaving children exposed to potential danger while transmitting highly sensitive legal documents without basic encryption. If "elite" European lawyers cannot even handle a PDF securely, you can only imagine the absolute anarchy inside Steam’s outsourced Russian support centers.

This lawless behavior cannot continue. A platform that actively accommodates a state-sponsor of terrorism, facilitates sanction bypasses, and prioritizes corporate wealth over basic child safety does not get to hide behind empty apologies. They must be held accountable in every single jurisdiction they exploit.

If they refuse, claim they don't keep logs, or hide behind a corporate NDA to protect their outsource staff, forward that refusal directly to your DPA. Mass legal action is the only language this monopoly understands.

Author’s Addendum: The Market Behind the Platform

On the Steam platform, recommended regional prices for Russia (and the CIS region as a whole) are typically 40–60% lower than the base US dollar price. Russia is classified as a Tier 2: Emerging Market, which generally receives a 40–50% discount off the base price. For example, a standard indie game priced at $19.99 (which would be around 1,900 rubles upon direct conversion) should cost around 419–499 rubles according to Valve's recommendations.

It needs to be stated clearly that the outsourced support is located in Ireland, but it is staffed by Russians—and some of the staff are based directly in Russia. Oh, and by the way, CSGOFast owns the popular SteamInventoryHelper extension, which is used purely to advertise their child-targeted casino (a casino that is banned in several European countries). And who owns this casino? That's right, Russians, just like the majority of similar sites. Does Steam not know this? Or do they just not want to know, considering the shadow market turnover is around a billion dollars, I believe.

Furthermore, I estimate that 40% of CIS scammers who currently run crypto scams got their start on Steam. I personally know of at least two specific cases of money laundering through skins. I won't detail them here, but I can if needed—just not publicly, as I don't want to name the platforms, etc. But Steam is well aware of this. Or do they actually expect us to believe that players who don't even own the game are just buying the exact same item over and over just to "play" with it? Yeah, right, it's a joke.

Steam's priorities are as pro-Russian as it gets—both in pricing and legal terms, as well as in popularizing Putin, flags, and banned terrorists. But Steam seems to like that, just as they tolerate antisemitism, discrimination, harassment, stalking, and drug dealing. For Steam, this is perfectly fine, just like 18+ games. They apparently enjoy it.

This is not a short-lived policy dispute. Russian officials and industry working groups have spent well over a year developing a videogame-control regime that includes player identification through a Russian telephone number, the state Gosuslugi identity portal or the state biometric system. Steam and GOG were expressly named among the platforms the proposal could affect, and participants said the underlying government working group had already been meeting for almost a year and a half by December 2024. Valve has made no comparable public commitment that it would leave the Russian market rather than connect its users to this state-directed identity architecture.

The contrast is obscene. Major industry players suspended sales or services in Russia—Microsoft halted all new sales, while console platforms and publishers announced their own withdrawals—yet Steam chose continuity. It continues providing commercial and social infrastructure to a country that the European Parliament formally recognised as a state sponsor of terrorism and a state that uses means of terrorism.

That support is visible inside Valve’s own economy. The official Steam Community Market lists a purchasable “Putin & Trump” profile background and thousands of items named “Putin forever,” “Putin smile,” “Putin like” and “Putin angry”. Valve did not draw these images, but it distributes, lists and monetises them through a Valve-operated marketplace. At the same time, in cases we documented, harassment based on nationality is allowed to remain visible or is treated as ordinary community conflict. Steam’s message is unmistakable: political propaganda can be monetised, while the people targeted by national-origin abuse are left to absorb it.

Private Ownership Is Not Legal Immunity

Valve is privately held and its shares are not publicly traded. That means its ownership structure, investors, internal controls and financial incentives receive far less routine public scrutiny than those of a listed company. It does not mean that consumer-protection law, child-safety duties, data-protection law or national regulators cease to exist. If Gabe Newell aggressively defends the right to sell explicit adult and hentai games on the same platform frequented by minors, yet hires expensive lawyers at Taylor Wessing specifically to stonewall basic GDPR transparency requests, it exposes a grotesque distortion of priorities. Perhaps Valve’s executive leadership is comfortable shielding attorneys whose main public notoriety stems from a high-profile sexual harassment lawsuit against their own firm, but EU regulators and data protection authorities will not be so easily intimidated. If Newell and his highly paid legal proxies prefer playing cozy corporate games instead of protecting kids and complying with international law, they are about to face a harsh legal reckoning. Satire / Joke

Valve’s own Subscriber Agreement says Steam is not intended for children under 13, yet Newell’s legal department has spent years aggressively rewriting these terms to extort and intimidate the teenagers who dominate the platform. For a long time, the agreement explicitly contained a vindictive retaliation clause: it stated that if a user sought any independent legal aid, went to court, or filed a class-action lawsuit against Steam, Valve reserved the right to retaliate by instantly deleting their Steam account, destroying their digital items, and wiping out their entire virtual library. By isolating users and forcing them under the exclusive jurisdiction of the US District Court for the Western District of Washington, Valve created an environment of legal terror designed to scare minors away from asserting their basic legal rights. A self-declared date of birth, a warning page and preference filters are not meaningful age assurance; they are cosmetic gates designed to let Valve exploit children under coercive, lawless contract terms.

Rights holders should also explain why they accept this adjacency. A family game, a children’s title or a mainstream release can sit one recommendation or search result away from explicit material, while Valve collects money from both. Publishers spend fortunes protecting their brands, yet appear willing to ignore what surrounds those brands inside Steam. Private ownership does not make this responsible, and market dominance does not make it inevitable.

Valve’s moderation principles become even harder to defend when compared with its response to Russian state censorship. In 2024, Roskomnadzor announced that Steam had removed all material demanded by the agency and that 11 Steam URLs would consequently be removed from Russia’s prohibited-information register. In 2025, Steam removed material from the page of an adults-only game after another Roskomnadzor demand concerning so-called LGBT “propaganda.” That was political censorship applied even to an 18+ work, not protection of a child who had bypassed an age gate. Valve can comply with a Russian censorship list, yet somehow remains helpless when asked to protect users from national-origin abuse, illegal gambling funnels or predatory adult-content exposure. That is a choice of priorities, and it raises an obvious freedom-of-expression question.

Valve has also issued no public corporate response to Russia’s invasion of Ukraine comparable to the companies that suspended operations or openly supported Ukraine. Its private capital structure does not require the kind of investor disclosure expected from a public company, so outsiders cannot fully examine whose incentives are being protected. What remains visible is an extraordinary attachment to a lower-priced market associated with industrial-scale cheating, gambling, account theft and sanctions-evasion services. Perhaps the reason will become clearer if Steam ever agrees to a Gosuslugi identity connection.

The outsourcing story follows the same pattern of opacity. Valve contracts companies, not the individual support workers presented to users. According to a primary source and materials we reviewed, a person connected to the earlier high-value inventory theft scandal did not disappear from the small support-contractor ecosystem: he moved to a different agency. He later claimed that he was not working for Steam and did not know the account was connected to Steam. Yet the trail led back to Ireland, to the same person and to Steam again. This account should be investigated as an outsourcing and access-control failure; it is not presented here as a criminal judgment. Valve should disclose which agencies can access account systems, how personnel are re-screened when they move between vendors, and whether an individual removed from one contractor can simply reappear through another.

Vietnam already demonstrated that Valve’s private-company status does not place it above national law. Steam was blocked there after authorities said Valve had failed to cooperate. Vietnam exists. EU law exists. Every jurisdiction Valve monetises exists, even when Valve behaves as if only “any court in Russia” matters. And if the theory is that Steam may operate wherever it wants, under whatever hidden arrangements it wants, with no meaningful accountability, perhaps we should ask the absurd question directly: is there also a special Steam for North Korea that nobody has disclosed yet?

These are established facts: the support team is Russian, and this support has repeatedly stolen or handed over information to fourth parties to restore access to dormant accounts in order to hijack them for profit.

If Valve believes that offering deep Russian discounts and monetizing terrorist propaganda is just a geopolitical policy, and if their incompetent lawyers can only intimidate, threaten, and leak minors’ data while stalling GDPR requests, then they can take their week-long delayed apologies and shove them. We do not need Valve’s permission, Taylor Wessing’s threats, or three-week delays to hold a corporation that loves Russia and despises European rights fully accountable. Steam has spent years deceiving and coercing its users into lawless terms. We call on every affected citizen to stand up, know your rights, and refuse to be manipulated. And to the hackers who exposed the security vulnerabilities of Steam’s porous logistics partner: since Valve has systematically failed to protect or notify its own victims in a timely manner, we would be glad if you used this report to directly notify the leaked users of their compromised data. Let them demand their lawful GDPR Article 77 rights, rather than absorbing the deceptive games of a greedy, manipulative monopoly.

PhishDestroy will continue to monitor, investigate, and expose. The shadow economy will be brought to light.

Given the direct conflict of interest and the adversarial legal posture of Valve's representatives, Taylor Wessing, direct coordination through them to reach the data breach victims is not feasible. This independent public report serves as the primary instrument of disclosure for the affected EU citizens whom Valve and its partners failed to safeguard.