Twilio denies breach following leak of alleged Steam 2FA codes

A threat actor claimed to possess and offered for sale a trove of Steam one-time SMS authentication codes (allegedly 89 million records); BleepingComputer reviewed a 3,000-record sample that included historic SMS codes and phone numbers. Twilio and Steam have denied breaches of their systems, and analysis suggests the data may have originated from an intermediary SMS provider or from abused credentials rather than a direct compromise of Twilio or Steam; the dataset contains some recent entries but whether the records are exploitable remains unverified.