{ "compartment_id": "section-14", "number": "Section 14", "title_local": "Support access and the theft ledger", "title_english": "Support access and the theft ledger", "source_url": "https://phishdestroy.io/steam_dossier/#insider-threat", "source_document": "index.html", "content": { "html": "
\n
\n
Part C — Legal frameworks
\n
Part C — Legal frameworks · Section 14 · Personnel access

Who can reset the safeguards?

\n
Context & source limits

Account security also depends on the people who can recover an account, inspect private records or reset its safeguards. The investigation must follow those privileged actions as closely as it follows API abuse.

Account recovery hands a support agent the power to move an account away from its owner. Valve has confirmed in writing, twice — February 2023 and November 2025 — that this power was used to hand accounts to the wrong people. Thirty-three months apart, through the same channel. Below: what that access is worth, six sourced cases, and the log Valve holds for every one of them and has produced to nobody.

\n
\n
\nPreserved testimony / 9 May 2025

A recovery ticket that disabled the account's security, and a reported $10,000 loss

\n

A user in the collected support archive reports that Steam Support reset the password and disabled account protection after another person submitted a recovery ticket. The author says the account had been inactive for years, held items since 2016–2017 and had Steam Guard, a linked phone and stored recovery codes.

\n
\"Steam Support still gave someone else access to my account.\"
\n

First-person allegation, preserved in steam_support_tickets_MEGA.json, record 110. Read the complete captured post ↗

\n

This is not one user's bad luck. The same door — a help request that moves an account to whoever supplies the older data — is the documented way in for every case in the ledger below, and Valve has twice put that in writing.

\n

The owner cannot win that argument. Recovery asks for the first CD key, the first email, the first card, the first phone number. Those facts are in Valve's database, and support-side access reads them — reported as reaching back fifteen years. A person who has a copy of your file will always produce more of your history than you can. Targets were picked to fit: dormant for years, high-value, and often bought second-hand, so the holder never knew the original key. Afterwards the accounts were deleted outright, breaking the item-history trail the community uses to trace a skin — a deletion an ordinary user cannot perform without the standard waiting period.

\n
Least privilege / OWASP A01

Recovery privileges should be limited to the task, independently reviewed and logged. Audit who could reset credentials, remove Steam Guard, read billing records or export account data. OWASP access-control guidance ↗ archived 2026-09-20 ↗

\n
\n
\n
Broad support accessAccess-scope risk
\n

Beyond the inventory.

If broad support access is abused, private telemetry can become a tool for profiling, targeted phishing and surveillance. Potential victims include ordinary users, military personnel, public figures and their families. This is a threat model; the exact permissions require access-control records.

\n
\n
01 IP history & location
IP logs can expose network history and approximate location. They do not, by themselves, establish precise physical movements.
\n
02 Device fingerprinting
Device identifiers, where collected and accessible, can connect sessions and accounts.
\n
03 Activity telemetry
Login timestamps and session records can reveal routines, including activity invisible on a public profile.
\n
04 Communications & contacts
Access to retained messages or contact information would increase the scope for profiling and social engineering.
\n
05 Identity unmasking
Original email, phone and payment records can connect a pseudonymous account to a person.
\n
06 Data resale & accountability
Exported target lists could support targeted scams. Establish the actor, access location, recipients and transfers; location alone establishes neither access nor legal immunity.
\n
\n

Valve describes IP logging, device information, payment records and third-party support providers in its Privacy Policy §§ 3, 5.2 archived 2026-09-21 ↗. The policy authorises third-party support access — the audit trail that would show which contractor accessed which category, when, and under what authorisation has not been disclosed.

\n
\n
\n
\n
Section 14.1 · the register · June 2022 → November 2025 · every figure sourced

Valve admitted the door twice, thirty-three months apart. It never closed.

Six reported cases in which accounts were taken through Steam's own help-request channel, or through the credentials that channel protects. Each amount is the figure the cited source published, and each source is named. Two of the six were made whole. The difference between them and the rest was not what happened — it was who was watching.

\n
Valve, in writing — February 2023\"The items in question were removed from your account because they were received from an account that was compromised through a support help request, for which the CS:GO team takes responsibility. We have reversed the trades and removed them from any account which received them.\"Steam Support reply to a recipient of HFB's items, reproduced by Dexerto, 21 February 2023 ↗ archived 2025-08-18 ↗
\n
Valve, in writing again — November 2025 · 33 months later\"A support technician that handled the help request failed to follow our process which resulted in your account restored to someone else. I apologize for this error.\"Steam Support reply to Hawkeye337, quoted in Dexerto, 14 November 2025 ↗
\n
\n
\nFilter cases:\n\n\n\n
\n
\nRestitution: 100% viral vs 0% non-viral\n
\n
\n
    \n
  1. 21 Jun 2022
    HFB — the largest inventory in the game$2,000,000+ · raised to $3,000,000+ in the February 2023 follow-up

    Seven Souvenir AWP Dragon Lores and the #1 Blue Gem Karambit, that knife alone valued at about $1.26 million. The account had been dormant three years with the mobile authenticator still active; the email and password were changed anyway, through the support recovery route.

    The money left before the items did. A reported $200,000+ of sale proceeds was already withdrawn through market.csgo.com — a marketplace that settles in cash and crypto. Reversing a trade returns a skin. It does not return the cash somebody already banked.

    And the fix broke. One buyer moved his Souvenir Dragon Lore into an in-game Storage Unit. Valve's rollback script could not see inside its own container, so it issued the owner a fresh copy and left the hidden one standing — Valve duplicated a $130,000 item while trying to undo a theft. It was caught by matching item IDs and community reporting, and deleted a month later, in July 2022. The buyer was refunded by BUFF, not by Valve. Emergency remediation this brittle is not a control; it is what a platform does when it has no control.

    Dexerto, 21 Jun 2022 ↗ archived 2022-07-02 ↗ · Kaspersky ↗ · cash-out figure per Esportfire, 22 Jun 2022 ↗ archived 2026-05-15 ↗, attributed there to multiple Twitter sources · duplication and deletion per Esportsbetting, 14 Jul 2022 ↗

    RestoredTrades reversed. Items pulled back out of the inventories of people who had paid full price for them.
    2. \n
  2. 14 Aug 2022
    CS.Money — the platform's own bots$6,300,000 · 19,000+ skins · first estimate $1.6M

    Attackers took the mobile-authenticator files of the marketplace's trading bots and emptied them, then sent part of the haul to well-known traders to blur the trail. Community researchers mapped 55 attacker accounts within hours and published them.

    Valve reversed nothing. The reason given was that a third-party site sits outside Steam — the same Steam whose inventory, trade API and account system the theft ran on end to end.

    Esportfire, 14 Aug 2022 ↗ archived 2025-11-15 ↗

    RefusedNo reversal. Loss stayed with the platform and its users.
    3. \n
  3. Reported
    21 Feb 2023
    Qkss — same door, same actor$1,000,000+

    Reported as taken the same way HFB was, by the same actor, through the same support help request. HFB was made whole eight months earlier. Qkss was not.

    One route. Two answers. Nothing in the published record distinguishes the two cases except the size of the audience.

    Dexerto, 21 Feb 2023 ↗ archived 2025-08-18 ↗

    RefusedNot restored.
    4. \n
  4. Reported
    Feb 2023
    The insider trade itself — a year of it≈ $320,000 · proceeds over roughly one year, not an inventory valuation

    Support-side access reached account history up to 15 years old — the first CD key, the first email, the first card. That is exactly the evidence the recovery process asks for, which is why the person holding the database always wins the argument against the person holding the account.

    Blogger Mzkshow exposed how insider operator \"Steam Help\" and collaborator \"Alexander\" targeted dormant accounts holding over $100k in skins. One stolen M4A4 Howl carrying iBUYPOWER and Titan Katowice 2014 holos sold for $35,000 and ended up with NAVI's Valerii \"b1t\" Vakhovskyi, who had no way of knowing. After Valve intervened, the contractor dismissed its entire Steam support desk.

    VKPlay ↗ · Lis-Skins ↗ · Escorenews (RU) ↗ · Dexerto (EN) ↗

    No registerValve has never published how many accounts this touched, or told the people it touched.
    5. \n
  5. Reported
    2 Dec 2024
    \"Matvey\" — after the sackings$13,000

    Recovery was granted to someone who supplied account data the owner himself could not match. Two years after the contractor cleared out its Steam support desk, the same route produced the same result.

    Preserved post, 2 Dec 2024 ↗ archived 2025-08-05 ↗ · source rows & hashes ↓

    RefusedNot restored.
    6. \n
  6. 13 Nov 2025
    Hawkeye337 (Mark Spurlock) — and the second admission≈ $300,000–$500,000 · full Katowice 2014 holo collection

    The attacker demanded 1 bitcoin and began scraping the collection onto Negevs to destroy it. Steam Support's written reply is the second admission above: a technician handled the help request, did not follow the process, and gave the account to someone else.

    What produced the fix was the feed. Hours after the posts tagging Valve went up on X, the account was taken back and every sticker restored. Qkss did not have that audience.

    Skin.club ↗ · Dexerto ↗ · Esportfire ↗ archived 2025-12-17 ↗

    RestoredReversed within hours of the story trending.
    7. \n
\n

What the ledger says that no single case does.

The route never closed. The first admission is dated February 2023 and the second November 2025 — thirty-three months apart, with the contractor's mass dismissal, a documented recurrence and a $6.3 million platform breach in between. Counting from the first theft in this ledger, the channel stayed open for three years and five months. Whatever was fixed in 2023, the help request still moved an account to the wrong person in November 2025 — Valve's own sentence.

Restitution tracked attention, not harm. Restored: the biggest inventory in the game, and the collector whose thread trended. Refused: $1,000,000, $6,300,000, $13,000. Valve has never published the rule it applies, because a published rule would have to explain those three.

Nobody was told. Not the users whose account histories were read out of the database, not a supervisory authority, not the market that bought the items in good faith and had them clawed back. There is no breach notice, no incident report, no count of affected accounts — and the proceeds left as money, through marketplaces that pay in cash and crypto. A trade reversal cannot follow money out of Steam.

Valve holds the support audit trail, the recovery-ticket log and the transaction record for every line above. None of it has been produced. Ask for your own copy →

\n
\n
The NDA question

Confidentiality must come with technical accountability.

Compare confidentiality agreements with actual permissions, export controls, reset approvals and access logs. A canned response cannot resolve an allegation that the recovery process itself was abused.

GDPR Articles 28, 32–34

Art. 33 gives a controller 72 hours to notify the supervisory authority of a personal-data breach; Art. 34 requires telling the affected people when the risk to them is high. Valve has confirmed in writing, twice, that its support channel handed accounts to the wrong people — account history, billing records and all. No notification under either article has been published, and no affected user has reported receiving one. Read the regulation ↗ archived 2026-09-20 ↗

Include support access in your request →
\n\n
\n
" }, "original_content_sha256": "47ab765d79b8cae2c5cb2a197b4d0d6a7ef72128a6af9afb92c48ca8b6c2bcf0", "author_pseudonym": "Agent Tom", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_14_agent_tom.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_14_agent_tom.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_14_agent_tom.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_14_agent_tom.json", "signature_file": "steam_dossier_section_14_agent_tom.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_14_agent_tom.pdf", "sha256": "be4485a465d3e0f4c68c9c114708bf2228c11e426b005d78a99686326b98b727", "pages": 7 } }