You mean second time, right?
http://www.neogaf.com/forum/showthread.php?t=1084810
Looks like that time they sent emails a day later.
I wasn't aware of that. Again, it's indefensible.
Let's get the stories in order.
The first incident was actually in 2011, where the forums (that were separate from Steam at the time) were hacked but there was apparently no evidence that anything was taken. There was access to a whole bunch of stuff though, most of which was encrypted in the usual way. This the message that was sent out afterward -
http://store.steampowered.com/news/6761/
Second incident was just this year, when they introduced two factor authentication and new account pages, and for some reason you didn't actually need to enter anything for the confirmation key to reset an accounts password, and so could just do it. Arguably this wasn't as awful as it sounds as the issue was at least somewhat trackable and could be reversed, as well as account access being denied to everyone who had SteamGuard enabled (which is on by default) - however I'm not sure what happened if you didn't have SteamGuard and what could happen. Here is the email that was sent only to the affected users:
Dear Steam User,
On July 25th we learned of a Steam bug that could have impacted the password reset process on your Steam account during the period July 21-July 25. The bug has now been fixed.
To protect users, we are resetting passwords on accounts that changed passwords during that period using the account recovery wizard. You will receive an email with your new password. Once that email is received, it is recommended that you login to your account via the Steam client and set a new password.
Please note that while your password was potentially modified during this period the password itself was not revealed. Also, if you had Steam Guard enabled, your account was protected from unauthorized logins even if your password was modified.
We apologize for any inconvenience.
And now there is today's issue, which is massively different, where contact info was randomly shown to other random people in a nonspecific way due to the nature of the caching issue (if accurate). As such it wouldn't be possible for people to get all the info on a specific person, but they could definitely take a whole bunch - account name, email address, last digits of phone number and CC if via the account page // name, address, phone number, last digits of CC or email address if at the cart.
Rather than being like the PSN hack, where massive amounts of data was identifiably stolen including all personal info / contact info and encrypted CC info, this is randomised but could still have large repercussions depending on if nefarious parties got involved. It would have been possible to "mine" the exploit and sceencap the random person's details, so it might be possible that sooner or later there is some sort of dump on pastebin or something putting all that info wide open.
The worst thing here though (other than compromising personal info) is Valve's lack of communication during it. People could have avoided being at risk by not looking at the cart or account pages (ie where personal info gets shown / cached) during that period. Instead, many people heard the issue and innocently tried to change the info, inadvertently making it a accessible.
