Support NeoGAF

[Cess007]

You know shit is serious when something is trending worldwide.

Wait, wait, what? "Explotan marcianos en la casa", que demonios? :O

 

[DeaviL]

If you added a new card it would auto-fill your old information including address and phone number.

Does steam or your local cache have that info though?

 

[kevm3]

Just a hypothetical... but say that Steam goes out of business. All your games go up in smoke with it, correct?

 

[Ucchedavāda]

This is absolutely nuts.
How does something like this happen? I can't imagine that Valve would have been pushing changes to their infrastructure in the middle of a huge sale, but what do I know. It's just too bad that we probably won't get a dissection of this afterwards, since Valve will surely be as silent as usual.

 

[Grief.exe]

Steamdb just posted a blog

https://steamdb.info/blog/recent-caching-issues-on-steam/

Disclaimer: Steam Database is not affiliated with Valve in any way. We are a community run website.

An hour ago, Steam users started seeing incorrect information on the Steam Store, as if they were signed into someone else's account.

There is no official confirmation from Valve yet, so we can only speculate as to why this issue happened. Valve is known to use Akamai as their CDN and Varnish for caching. Our theory is that a caching misconfiguration in one of these components has caused Steam to incorrectly serve rendered and cached pages intended for a single user only.

This issue means that users’ private information such as email address, billing address, and sometimes credit card details are at risk. As far as we know, this issue is read-only, and no one is able to perform any actions involving your account on your behalf.

To protect yourself, we strongly recommend completely avoiding visiting any Steam store links. This includes visiting the Steam store using the Steam client.

This is not a hack or a DDoS attack. This is highly likely to be a misconfiguration in one of Valve’s caching layers.

At the time of this writing, the Steam store is inaccessible. We can only assume Valve is currently working on fixing the issue.

If you used a PayPal account and had the details saved, you can unlink your account by logging on PayPal.com and going to Settings and Preapproved payments under the Payment options heading.

Going forward, we strongly encourage you not to store your billing information on the Steam store. Valve have proven multiple times that they’re unable to keep their security standards to a high level.

 

[lifa-cobex]

I think there have always been lingering trust issues with Valve over CS problems, but this is going to cause them a lot of problems in the future.

Doubt it.
Sony took a smack in the chops and I would say they are back on track.

 

[Anthony Soprano]

Why would you want to remove the paypal account if it makes you log in with paypal again before a purchase can be finalized?

The only thing is does is protect someone from viewing your paypal e-mail address, which arguably gives a would-be hacker very little ammunition besides a little more social engineering bait. I'd rather just leave my paypal on the account to avoid any issues reattaching it in the coming days of the sale.

 

[Steel]

Steam stores the three digit code as well as the full credit card number. I've never had to add the CVV number when using a stored card on Steam.

Oh wait, now that I think about it there's a checkbox to store it. Never hit it, fortunately.

 

[Stealthy Giant]

Thank God I removed my CC info after my last purchase.

 

[Zom]

I didn't see any either, maybe someone browsing caches or /v can confirm.

.

Far has I could tell, one could see phone numbers and address just from people with credit cards, you could edit the information of the card, change the type like from visa to mastercard and all the blank spaces of addresses and phone number would fill up.

 

[RK9039]

I'm calling my lawyer

Better call Saul.

 

[Stumpokapow]

This is absolutely nuts.
How does something like this happen? I can't imagine that Valve would have been pushing changes to their infrastructure in the middle of a huge sale, but what do I know. It's just too bad that we probably won't get a dissection of this afterwards, since Valve will surely be as silent as usual.

My guess is that if it wasn't an external breach then it was some weird cascade failure scenario (i.e. heavy load leads to components failing in an unusual order). I hope Valve provides at least the general basis of what happened.

 

[benny_a]

Does steam or your local cache have that info though?

Why would my local cache have the address information of some random dude?

If I saw my own account information on Steam that wouldn't be relevant to this privacy breach.

 

[Molemitts]

The OP says don't unlink card details, but people some people here are saying you should? What do I do?

 

[chrominance]

Looks like GiantWaffle from twitch was able to see somebody else's full address and phone. AFAIK he was using the android steam app and not the PC client or website.
No idea if it is actually true, but worth checking if the andriod/ios apps leaked more information than the website/pc client.

You could see it from the website and PC client too (the PC client is, after all, just a built-in browser view).

 

[Grief.exe]

Looks like GiantWaffle from twitch was able to see somebody else's full address and phone. AFAIK he was using the android steam app and not the PC client or website.
No idea if it is actually true, but worth checking if the andriod/ios apps leaked more information than the website/pc client.

http://www.neogaf.com/forum/showpost.php?p=190421358&postcount=221

From this very thread.

Phone numbers were absolutely 100% exposed, I saw them with my own eyes. It relied on you having stored your billing address info at one point in Steam (so if you never did this you are definitely okay, and if you removed your billing details you may also be okay if Valve deletes your saved info), but all that info was exposed if you knew where to look.

Far has I could tell, one could see phone numbers and address just from people with credit cards, you could edit the information of the card, change the type like from visa to mastercard and all the blank spaces of addresses and phone number would fill up.

Will update my information post.

 

[MageBoySA]

Steam stores the three digit code as well as the full credit card number. I've never had to add the CVV number when using a stored card on Steam.

It doesn't for me and I'm in the US. That may be your bank allowing that. I have to put in my three digit code everywhere but Amazon.

 

[nded]

So if you weren't logged in when this happened are you safe?

Nobody knows. Keep an eye on your accounts to be safe.

 

[blankempathy]

Well we are talking about money here... Hard earned money that is open to some jerk who wants to purchase stuff because lolz. I don't know if you are compromised or have ever gone through identity theft.. But this is no calm matter at all and it irks me that some people are saying being level headed in a situation which could possibly ruin you for life is recommended... acting like this is some level headed situation. Wtf?

Like please don't.

Because some of us have first hand experience with having our cc actually stolen. I posted before that if you have a good bank they will take care of you. Monitor your bank account. Look for any charges you haven't made. Change your debit or cc by canceling and ordering a new one if it gives you peace of mind. Banks will contest fraudulent charges.

 

[Devildoll]

Just a hypothetical... but say that Steam goes out of business. All your games go up in smoke with it, correct?

no, they have a plan in place for that.

if i remember correct, something about you being able to download them for like a few months, and them then working without steam being operational.

 

[M.D]

I can't remember if I ever used my CC directly with Steam, but all my details would get automatically filled in whenever I made a purchase with Paypal and I also set up that security thing via your phone recently

I didn't get any emails from Steam, hope everything is okay

 

[Rebel Leader]

Is steam back on yet?

 

[Ruruja]

Why would you want to remove the paypal account if it makes you log in with paypal again before a purchase can be finalized?

The only thing is does is protect someone from viewing your paypal e-mail address, which arguably gives a would-be hacker very little ammunition besides a little more social engineering bait. I'd rather just leave my paypal on the account to avoid any issues reattaching it in the coming days of the sale.

I think there's a way where you can just click Purchase and it does it all automatically with no additional login.

If there isn't I have no idea why either.

 

[KingBroly]

Doubt it.
Sony took a smack in the chops and I would say they are back on track.

Not many people buy from PSN with a CC anymore, only PSN cards. There's a reason why PSN cards are so consistently among best sellers and it's that.

 

[Arrogant Bastard]

Nobody knows. Keep an eye on your accounts to be safe.

Well I was logged into the android app...

 

[Mavromatis]

SteamDB posted at their blog.

 

[Cheeseman Battitude]

The only reason I'm still not quite confirming them is it's possible they bought something in previous days and their financial institution is just logging the charge. No need to fear monger until we have absolute concrete proof.

My sale purchases from yesterday still don't show on my CC statement on my bank's website. I've never had a need to check this info so immediately before, so I'm surprised it takes this long.

 

[Random17]

If my steam profile is on private, and I was never online, I should be okay right?

 

[NaM]

I also saw a full phone number from the mobile app.

 

[GuardianE]

I'll just keep a close eye on my e-mail and cards for now. I don't know how passwords could possibly be compromised.

I also saw a full phone number from the mobile app.

A lot of phone numbers were definitely visible.

 

[TheLostBigBoss]

If my steam profile is on private, and I was never online, I should be okay right?

no

 

[DeaviL]

Why would my local cache have the address information of some random dude?

If I saw my own account information on Steam that wouldn't be relevant to this privacy breach.

So Steam then.
I thought you were talking about when you were adding a new CC in.

 

[lifa-cobex]

Not many people buy from PSN with a CC anymore, only PSN cards. There's a reason why PSN cards are so consistently among best sellers and it's that.

ahh fair point.

So I guess Steam cards sales will probably be on the rise then

 

[Plum]

I don't even know what the hell that means TBH. Maybe you don't have a bank account tied to your paypal or need to verify an email address on your account?

I've removed the bank accounts but I can't remove the cards. I've delinked Steam from it so it should be fine anyway.

Hopefully.

 

[Steel]

My guess is that if it wasn't an external breach then it was some weird cascade failure scenario (i.e. heavy load leads to components failing in an unusual order). I hope Valve provides at least the general basis of what happened.

Just out of curiosity, since we know your account was one of the ones effected, were you logged in or out when it happened?

 

[Cheeseman Battitude]

I'm calling my lawyer

Lionel Hutz probably doesn't work Christmas.

 

[DeaviL]

no

Maybe or yes.

 

[chinaismine]

SteamDB posted at their blog.

SteamDB has no affiliation with Valve, they're just guessing at what happened. I don't understand why people keep linking to them...

 

[Haunted]

So how do we reconcile the different information from those speculating about the nature of the breach/caching problem maintaining that no action should have been possible on the read-only account info with the reports of people having their accounts cleared out/posting financial statements showing they've been charged?

SteamDB has no affiliation with Valve, they're just guessing at what happened. I don't understand why people keep linking to them...

Even if it's not an official statement, I think it's helpful to post consolidated information about what is known (and not known) from people who are more knowledgeable about this stuff than your average concerned user.

You're obviously free to ignore it, but I don't think it's hurting anyone.

 

[Rebel Leader]

I'm calling my lawyer

Sorry Blame Space,

You are on your own. After That TV debacle I can no longer defend you. Find yourself another lawyer.


Rebel Leader
Rebel Defenders PLLC

 

[Kwansu Dudes]

Valve...

 

[Svafnir]

SteamDB has no affiliation with Valve, they're just guessing at what happened. I don't understand why people keep linking to them...

Because there is nothing official yet. But there really should be. Valve is dropping the ball here.

 

[cyba89]

Guide to unlink Valve from Paypal.

1. Log in
2. Access your settings through the cog in the upper right hand corner
3. Click Preapproved payments
4. Click Valve, corp
5. Select cancel option

Thanks. I guess I can sleep a bit better tonight now. Well, safe for fear of losing the 0,42€ I had in my steam wallet.

The (non-)communication about this on Valves part is completely awful and inexcusable though.

 

[Sora_N]

Fuck

 

[lifa-cobex]

Lionel Hutz probably doesn't work Christmas.

Try Miguel Sanchez

 

[matrixman92]

wait, so we DONT login and unlink cards? I last logged in maybe 3 weeks ago

 

[Shepard]

The only reason I kept my Cc info there was because I thought I was safe with the 2-steps verification. Fucking Valve had to create a new Fucking way of exposing user data. Shit.

 

[strafer]

The silence is really making me nervous...

All they had to do is post a short message on Twitter or their site or Facebook or whatever... anything really, not being silent.

 

[Salbug]

I noticed earlier today I had Outlast, and it's DLC in my cart again after I had bought them both last night, and that was like the first sign I noticed something was up. This whole mess with Valve being silent is ridiculous though.

 

[Qassim]

Steam stores the three digit code as well as the full credit card number. I've never had to add the CVV number when using a stored card on Steam.

The CVV actually isn't necessary to do purchases, afaik it's up to the business to decide whether to require the CVV and when to require it. The reason for that is because if fraudulent purchases go through their system, it's the business that pays for it ultimately, so from that perspective the card issuers leave it up to the businesses. Steam does request the CVV depending on certain criteria even if it's a CC that has already been stored and used in the past many times. I get prompted every so often for it, but in your situation it just may be the case that the conditions to prompt for the CVV have never been met. Many merchants do this, Amazon for instance, so them not asking you for the CVV doesn't mean they are storing it.

IIRC it is also not permissible for merchants to store the CVV anyway, only until the authorisation has been completed.