Steam security issue revealed personal info to other users on XMas Day (fixed)

I have a linked PayPal account. Remotely deauthorized all logins via paypal.com and confirmed that there were no new purchases. That's good, I guess.
 
It's a caching server problem, so you can all stop panicking. This will not allow anyone to log into your accounts or access your payment information.

That said, it does allow random* people to temporarily view your e-mail address, name, and other info. In theory this could be taken advantage of... if a dedicated, inefficient thief happens to come upon your info.
 
Grief.exe said:
I wonder how many total accounts were compromised.

While people were posting account names at the beginning of the leak, I noticed I was seeing similar names to three other users.
Click to expand...

If the cache servers kept logs of the pages they cached, it might be possible to take all the generated pages and figure out which emails were exposed, etc.
 
Lady Siara said:
As has been stated, the best thing to do right now is if you're logged on, stay idle and don't open any pages (store, account, etc.) and if you're not, stay logged off.

The only truly safe step one can take at the moment seems to be unlinking your Paypal off site. Anything else may expose you.

The repercussions of this could be huge for Valve. I can't see them not offering credit monitoring (or more) if this is as bad as it seems. Fingers crossed it's only an unfortunate few and not every single user at risk.
Click to expand...

Oh Valve are going to get hit with a fine if this is a real breach, the Data Protection laws in the EU will hurt them big time. At the least they've lost a lot of people's trust and confidence in their service.
 
The easiest way to check if stuff has happened to your steam account at the moment is to go to the email that is associated with your account and see if you have anything from steam.
 
Well shit, I just got home and noticed steam wasn't working properly. Guess I shouldn't have opened steam?

Guess I'll just have to hope for the best.
Madchad said:
The easiest way to check if stuff has happened to your steam account at the moment is to go to the email that is associated with your account and see if you have anything from steam.
Click to expand...
I'm more worried about my phone number and email address becoming flooded with shit.
 
Man, who knows what person checked out my info. It's really scary.

I hope no one is collecting the info and shares it somewhere.
 
Alvarez said:
It's a caching server problem, so you can all stop panicking. This will not allow anyone to log into your accounts or access your payment information.

That said, it does allow random* people to temporarily view your e-mail address, name, and other info. In theory this could be taken advantage of... if a dedicated, inefficient thief happens to come upon your info.
Click to expand...

Already had a journalist confirm that he had 130 taken from his account, so you can stop running damage control.
 
spons said:
You can easily script this and make a bot to manually "hit F5 on the account page" so to speak in almost any simple programming language. Any programmer could have abused this during the hour that the leak was happening and could have gotten many, many profile details.
Click to expand...

well i guess you are right .

Just checked and steam is down completely now.
 
Grief.exe said:
I wonder how many total accounts were compromised.

While people were posting account names at the beginning of the leak, I noticed I was seeing similar names to three other users.
Click to expand...

I think that's the scariest part of all this. The fact that multiple users were seeing the same usernames makes it so much riskier for those unlucky enough to have their information popping up. It just increases the odds that it may have been seen by someone with malicious intentions.
 
It's unfair to expect a response from Valve, people. What do you expect them to do? It's Christmas. And contacting users to inform people is way too much! Are you unfamiliar with Valve as a company? Having somebody inform users of a significant security breach goes against their company structure. Who do you think they are, EA? They can't afford to hire somebody to handle this, and even if they did, the spirit of Valve would be lost forever.
 
Alvarez said:
It's a caching server problem, so you can all stop panicking. This will not allow anyone to log into your accounts or access your payment information.

That said, it does allow random* people to temporarily view your e-mail address, name, and other info. In theory this could be taken advantage of... if a dedicated, inefficient thief happens to come upon your info.
Click to expand...

There are reports of people having purchases happen on their accounts. Not just random people either. Guy who works for IGN reported it happened to him.

Edit: Not to menton your full phone number, email and address being leaked is alright reason to panic. So the idea of telling people to not worry is insane.
 
Alvarez said:
It's a caching server problem, so you can all stop panicking. This will not allow anyone to log into your accounts or access your payment information.

That said, it does allow random* people to temporarily view your e-mail address, name, and other info. In theory this could be taken advantage of... if a dedicated, inefficient thief happens to come upon your info.
Click to expand...

Why are you running damage control? Seriously read the thread.
 
Called my brother to tell him about the situation but I wasn't even sure of what to suggest exactly. Told him to avoid using the client and to try not logging in his account for now.
 
Disaster Nebraska said:
I'm highly doubtful this is a "caching issue". This sounds like a problem on Steam's end.

For starters, you don't cache everything at the CDN and information that's supposed to be encrypted is still encrypted. If Steam is caching all of this at Akamai they're idiots and it's still on them.

So even if it is "caching problem" it means that Stema has been caching unencrypted, raw account info at Akamai, though again, I'm very doubtful this is due to an issue there.

What seems more likely is that someone made an oopsie with the customer information database (drop a few key rows and suddenly info is showing up where it shouldn't have) or a straight-up hack.

Others are free to weigh in on this. I work in the webhosting industry and deal with CDNs on a fairly regular basis. Our company uses Akamai as well.
Click to expand...

I feel the same way, but then... this is the Steam Client we're talking about, it's needed a totally re-write for at least the last 5 years. I wouldn't be surprised if it's still using some of the same crap it had in 2004.
 
TheSpoiler said:
Already had a journalist confirm that he had 130 taken from his account, so you can stop running damage control.
Click to expand...

We can't let reality stand in the way of corporate loyalty.

DeaviL said:
Oh boohoo, i'm just asking because my login username and the one steam shows are entirely different.

Also, i'm totally doing overtime on my astroturfing duties, gonna reign in the big bucks.
/s
Click to expand...

Its the only explanation for your posts in this thread.

First it was "this is no big deal." Then "no personal information was leaked." Now its a trivial distinction between user and log in names.

Its a big deal. We can stop brazenly defending Valve and start asking for action.
 
YianGaruga said:
went to watch a random speedrun stream on twitch, everyone talking about Steam lol

they're fucked
Click to expand...
I see Steam GAF on 9gag. On 9gag!
am9L2Do_460s.jpg
Click to expand...
For some reason also way calmer than this thread.
 
Well got back to my house King's Quest is still downloading at 75%. At this point I think I don't really care all that much. My info is already out there thanks to the Chinese Federal database hack a few months back.
 
KScorp said:
If you haven't visited any pages that contain your personal info, you are OK. Basically, people can only see your info if YOU saw your info.
Click to expand...

I was playing for the past two hours - before that I was seeing the store in Russian, but I haven't bought anything since yesterday and didn't access my wishlist today either.
Am I already fucked just because I was playing?
 
LiquidMetal14 said:
So don't log in no matter what? I was just going to change pass but at least I have 2 step verification enabled with Steam Guard.
Click to expand...

same here but I just log in earlier, oh well at least I don't have anything saved there

my email and pass also created only for steam

my worry is phone number on steam guard are any significant?
 
Well, since I've already complained about the possibility of my account getting accessed (although, no e-mails about things bought, nor charges on my CC yet), let's look at the bright side. I was looking to start the Witcher today but was having a problem with Steam (no sound ingame) so I moved it over to GoG's client. Time to start it up, I guess.
 
ekim said:
Again. This is false. I made a purchase yesterday on my pc and today on my smartphone and I could use the authorized "my PayPal account" payment option without logging in to PayPal again.
Click to expand...

Well, that never happened to me, maybe I never authorized Steam to charge me without log in, I didn't even know you could do that.
 
TheSpoiler said:
Already had a journalist confirm that he had 130 taken from his account, so you can stop running damage control.
Click to expand...

130 dollars? Where did they went? If someone buys something with the wallet of another person the things he bought also stay in that same account. You could refund stuff in this case.
 
Alvarez said:
It's a caching server problem, so you can all stop panicking. This will not allow anyone to log into your accounts or access your payment information.

That said, it does allow random* people to temporarily view your e-mail address, name, and other info. In theory this could be taken advantage of... if a dedicated, inefficient thief happens to come upon your info.
Click to expand...

Before they pulled the plug I was able to see the edit card info page of another user.

In this same thread there was an image of that same page (for a "James").

I don't know about the rest but I'm not panicking. I'm just mad, mad at Valve and annoyed by the random people that try to make damage control for them.
 
at this point it wouldn't make much difference if it was a series of unfortunate events like a hardware failure on christmas day of all days, or valve being incompetent when it comes to security like that steamdb post is suggesting.

i dont think its gonna change my mind when it comes to storing payment info with steam, its gonna be more inconvenient than psn ever was, but the amount of info accessible is too much
 
spons said:
You can easily script this and make a bot to manually "hit F5 on the account page" so to speak in almost any simple programming language. Any programmer could have abused this during the hour that the leak was happening and could have gotten many, many profile details.
Click to expand...

You can also still access other peoples account pages through Google cache.
 
You must log in or register to reply here.

Similar threads

PSYCHO DEAD | Gameplay Reveal Trailer (Third-person survival horror) [PS5, Steam]
23
160
Macattk15 replied
  • Poll
Steam users threaten to boycott Metal Eden for using AI voices
News Drama  2 3
117
1K
rkofan87 replied
Digimon Story Time Stranger debuts with over 70k concurrent users on Steam (~11x the launch CCU of Digimon Survive)
Sales-Age 
5
102
Liopleurodon replied
Steam hits 40m concurrent users.
3 4 5 6 7
300
16K
rodrigolfp replied
[The Verge] Xbox Ally pricing and preorders info coming today. [Update] Prices revealed: $999 Z2 Extreme; $599 Z2
7 8 9 10 11
544
1K
Duchess replied
Top Bottom