Hacks aren't coming through steam. GGG has a vulnerability.

So I was hacked on the 31st, between 1 and 8 am NZ time. My steam records show no login between those times (last one from 12:02-12:20 am was my own quick check before bed). I also did not receive any steam 2fa login messages.

Therefore there must have been a login using GGG's own client. I had my password somehow changed without receiving any messages, and my in game account was logged in without any messages. This implies that there is a severe security flaw somewhere on GGG's side.

I was basically done with EA content anyway, but I'm sure it will feel bad if some new challenges are released. Hope GGG patches the vulnerability asap so that other players aren't affected for the new year. Would also be nice to have items restored but seems GGG doesn't do that for some reason.