Steam security issue revealed personal info to other users on XMas Day (fixed)
- Thread starter Quirah
- Start date
This seems to be the case for me and my mates.
I have not been on steam for some weeks and they have been on and off it all the time. Both have got emails saying some one trying to login to their accounts but i have not.
I did login to try and remove any payment details that may have been on there today but did not manage to reach it. Have had no emails as of yet saying anything has happened on my account at all.
Relaxed Muscle
Member
You can add Steam in the list of aprobed payments in PayPal, so PayPal login is not necessary.
I wonder how many total accounts were compromised.
While people were posting account names at the beginning of the leak, I noticed I was seeing similar names to three other users.
The fact that it is Christmas is also why this is probably not just some malfunction in the junction. And even if it were, it is a pretty god damn big one.
Kenzodielocke
Banned
You know. Shit can always happen.
But the fucking worst is Steams fucking communication on this. That shit is handled very bad.
But the fucking worst is Steams fucking communication on this. That shit is handled very bad.
Green Biker Dude
Banned
yes because microsoft has a history of being reliable and positive for pc gaming
Again. This is false. I made a purchase yesterday on my pc and today on my smartphone and I could use the authorized "my PayPal account" payment option without logging in to PayPal again.
Don't think its true. When I authorized steam in my paypal account I remember that i have made a few purchases without going to the paypal site at all. And i don't keep myself logged in to paypal.
GifGafIsTheBestGaf
Member
Wow, I can't believe this shit.
blackdevil
Member
it`s not like there is a clear list of all names, accounts, emails and so on out there. "Evil minds" would need to manually go through many accounts and it was random what account you can see.
Yup. That's my main thing. Just give people tips to be safe or how we should proceed.
They absolutely have workers on standby just in case something like this happens (I may be giving Valve too much credit), but it doesn't change the fact that they don't have all of their workers.
The Dear Leader
Banned
Yeah me too, I saw quite a few similar ones and I was getting a cycle of the same usernames when checking the store when it first happened.
Sharkiller
Member
Unacceptable. I demand Half-Life 3 as compensation.
Relaxed Muscle
Member
I can imagine the number of people checking their account is not large, specially if the new config gor into affect around the same time. But the number of people buying games, and getting cache'ed in every step of the confirmation process is much higher.
Lady Siara
Member
As has been stated, the best thing to do right now is if you're logged on, stay idle and don't open any pages (store, account, etc.) and if you're not, stay logged off.
The only truly safe step one can take at the moment seems to be unlinking your Paypal off site. Anything else may expose you.
The repercussions of this could be huge for Valve. I can't see them not offering credit monitoring (or more) if this is as bad as it seems. Fingers crossed it's only an unfortunate few and not every single user at risk.
The only truly safe step one can take at the moment seems to be unlinking your Paypal off site. Anything else may expose you.
The repercussions of this could be huge for Valve. I can't see them not offering credit monitoring (or more) if this is as bad as it seems. Fingers crossed it's only an unfortunate few and not every single user at risk.
If you don't have a paypal purchase receipt in your e-mail you're safe.
lifa-cobex
Member
I don't see any other alternative tbh
Enter the Dragon Punch
Banned
What we know so far
- Most likely an error in the way Steam caches pages.
- People are able to access random Steam profiles and see compromising information, account names, emails, last 2 digits of credit card, paypal email address, purchases, etc.
- Full addresses and phone numbers were able to be accessed.
- No changes can be made to the effected account, no purchases can be made. Any evidence to the contrary is, as of yet, unsubstantiated.
- It's been advised to not access Steam URLs, including the client, until we have more information.
- Do not post account names you see, huge security risk.
- Do not log into Steam to unlink your Paypal. If you feel the need, can be done from the actual Paypal website.
- Reminder: Steamdb is not affiliated with Valve in any way.
I'll update this post with more information going forward.
remove the username in the top right corner of the phone number example.
Looks like someone may have used my card. I see something was purchased on my card online that I don't remember buying and have no record of buying. Goddammit. I don't recall having my credit card info on Steam though. Unless I'm mistaking it for the Dishonored 2 pre-order at Target? Would my account show a pending transaction for a pre-order at Target?
Uplay is legit trash. Anyone who's ever had to patch Blacklist through that client knows that well. Let's not trying doing any revisionist history here.
man usually I stay off the grid for most of the day on Xmas but I bought a shitload of stuff for my close friends last night/this morning so I'm gonna be paranoid about this for a while
I delinked my paypal using the paypal site and changed all of my information
just gonna have to wait it out I guess =/
I delinked my paypal using the paypal site and changed all of my information
just gonna have to wait it out I guess =/
Yeah, but that's irrelevant. When you run a store you need to provide enough staff to cover emergencies.
And when you run an always online digital store, that includes staff capable of shutting down a major catastrophe like this. Valve took on the risk voluntarily, we can't just say "oh well its Christmas" and excuse their completely inept handling of the situation.
D
Deleted member 125677
Unconfirmed Member
Great thinking!
It's also a great time for Nintendo to be selling 3DS without chargers, and Sony to cancel Last Guardian because right now no one gives a fuck
Is it? When I purchase something from Steam using Paypal it always prompts me to log in.
Mr. Enigma
Member
It's been over three hours since people started noticing issues. In this era of be being able to Tweet while I'm taking a shit, Valve's lack of communication is completely heinous.
Ricerocket
Member
I still wouldn't use their windows app store. They aren't going to replicate all that steam accomplished.
Gemüsepizza
Member
Just remember that with prepaid cards you can only get a refund to your Steam wallet. With Paypal you can get a refund to your Paypal account!
If I can't trust Valve, I sure as shit don't think I can trust Microsoft.
Disaster Nebraska
Banned
I'm highly doubtful this is a "caching issue". This sounds like a problem on Steam's end.
For starters, you don't cache everything at the CDN and information that's supposed to be encrypted is still encrypted. If Steam is caching all of this at Akamai they're idiots and it's still on them.
So even if it is "caching problem" it means that Stema has been caching unencrypted, raw account info at Akamai, though again, I'm very doubtful this is due to an issue there.
What seems more likely is that someone made an oopsie with the customer information database (drop a few key rows and suddenly info is showing up where it shouldn't have) or a straight-up hack.
Others are free to weigh in on this. I work in the webhosting industry and deal with CDNs on a fairly regular basis. Our company uses Akamai as well.
For starters, you don't cache everything at the CDN and information that's supposed to be encrypted is still encrypted. If Steam is caching all of this at Akamai they're idiots and it's still on them.
So even if it is "caching problem" it means that Stema has been caching unencrypted, raw account info at Akamai, though again, I'm very doubtful this is due to an issue there.
What seems more likely is that someone made an oopsie with the customer information database (drop a few key rows and suddenly info is showing up where it shouldn't have) or a straight-up hack.
Others are free to weigh in on this. I work in the webhosting industry and deal with CDNs on a fairly regular basis. Our company uses Akamai as well.
I can't understand the people defending the total lack of communication from Valve during this, it's mind-boggling.
I love Steam, and Valve have made probably 5 of my top 10 games of all time, but this colossal fuck-up is being compounded by an utterly inexcusable failure to communicate on their part.
With a data breach like this, all potentially affected customers (and that's all of them, until you're sure it isn't) need to be notified ASAP, we are now several hours beyond that and still nothing.
I love Steam, and Valve have made probably 5 of my top 10 games of all time, but this colossal fuck-up is being compounded by an utterly inexcusable failure to communicate on their part.
With a data breach like this, all potentially affected customers (and that's all of them, until you're sure it isn't) need to be notified ASAP, we are now several hours beyond that and still nothing.
You should add a "*" to safe. Probably safe from being charged for things you didn't buy on steam, but the leaked personal information can be used for other types of scams.
FloatingDivider
Member
That'd be a sensible approach if publishers weren't assholes and required separate purchase for different clients.
spons
Gold Member
You can easily script this and make a bot to manually "hit F5 on the account page" so to speak in almost any simple programming language. Any programmer could have abused this during the hour that the leak was happening and could have gotten many, many profile details.
I deauthorized valve on the PayPal site already and email so far just to be sure.
Looking at the behavior I don't think people can accidentally buy something from other people's accounts. And even if so, the games won't be transferred to any other account. Additionally I only think it affects a small set of people that visited one specific site at one specific moment.
LiquidMetal14
hide your water-based mammals
So don't log in no matter what? I was just going to change pass but at least I have 2 step verification enabled with Steam Guard.
VisceralBowl
Member
On Steam a username is a login name. It cannot be changed.
The display name is what everybody generally sees.
Similar threads
- Poll