"We’re still digging into the source of the leak, which is compounded by the fact that any SMS messages are unencrypted in transit, and routed through multiple providers on the way to your phone," it says. However, the phone numbers that received the one-time codes are not associated with a Steam account, password information, payment information or other personal data.