Steam security issue revealed personal info to other users on XMas Day (fixed)

Could you imagine if banks worked this way?

"Sorry, you took the risk of getting your money stolen by banking with us at this location."

Your bizarre partially-at-fault view is just wrong.
Yep, that's a very twisted way of thinking. If companies provide a service, they are responsible for making it work as intended and protecting customers' information. If they won't do that, they shouldn't offer the service in the first place.

Blaming the customers is so ridiculous it makes my head hurt.
 
I wonder if any Steam user has lodged complaints with their local authorities for this leak. Especially in the EU it could be troublesome for Valve.
 
Its this kind of thing though that makes me never save any CC info on websites. And the fact that this seems like a self inflicted wound on Valve's part screwing up and not some malicious outside attack is definitely worrisome, especially when so much digital commerce is predicated on some level of trust that the company you're giving your personal information to isn't going to screw up like this.

Yup, the blame lies entirely with Valve it seems.
"Look everyone, we're giving out free user account info for Christmas!"
 
Yep, that's a very twisted way of thinking. If companies provide a service, they are responsible for making it work as intended and protecting customers' information. If they won't do that, they shouldn't offer the service in the first place.

Blaming the customers is so ridiculous it makes my head hurt.

The worst part about this, other than the grave breach of personal privacy, is finding out how many people are so entrenched into corporate loyalty that even when faced with such a breach they cannot criticize a video game store.

They blame the victim over admitting the company was at fault. What goes on in the mind when looking at the world this way?
 
So you think that's advice that normal people should be expected to follow?

For the record, I blame Valve for what has happened.

However I think people should try to learn from this experience. Hacks, mistakes and errors leading to leaks will always happen. It won't go away. Don't expect services to be 100% secure. We can all point fingers and grab our pitchforks, but the damage has still been done. Now again, blame Valve, but please be aware of risks in the future.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.

So if it's a caching issue, I should be safe right? I'm away at my parents house for holiday and haven't logged onto Steam since Tuesday.
You should be fine, the issue appears to be fixed. The only cached information currently showing up are caches on other sites when the issue first happened. If I'm not mistaken.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.
Yeah, the backlash was much worse.

Also, lol @ "knee-jerk reaction". Unbelievable how far some corporate apologists are willing to go.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.
Hahahaha.

But seriously, please stop posting nonsense.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.
Okay, now I've heard everything.

I'm speechless.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.

Yes there was. There were people selling their systems over it, denouncing Sony, calling them all sorts of names and so on. The backlash was actually worse.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites.

Again, my steam username (shared with other places) and e-mail is not connected to my IRL identity anywhere. Oh, and I do not voluntarily share my personal information on some social networking site.
 
For the record, I blame Valve for what has happened.

However I think people should try to learn from this experience. Hacks, mistakes and errors leading to leaks will always happen. It won't go away. Don't expect services to be 100% secure. We can all point fingers and grab our pitchforks, but the damage has still been done. Now again, blame Valve, but please be aware of risks in the future.

Even though you don't seem to doing the silly "consumer's fault too" thing other posters are, I want to clear something up.

Awareness of the risk doesn't impose any fault on the consumer. Valve created a digital storefront whose entire business model revolved around impulse purchases and continual, systemic transactions. They want, above all else, to have the CC information and file and do everything to facilitate that. Yes, obviously, there is always a remote risk of a privacy breach - but the fault lies entirely on the company. They have both a moral and legal obligation to protect the consumer, not the other way around.

So, even though we knew this kind of this abstractly could happen, it in no way softens the blow or shifts the blame.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.

You should be fine, the issue appears to be fixed. The only cached information currently showing up are caches on other sites when the issue first happened. If I'm not mistaken.

There is no equivalence between voluntarily sharing your personal information and having it divulged to random people when it shouldn't be. In some ways I consider this worse than the Sony breach because Sony was hacked while Valve was just sloppy. Thankfully no payment details were disclosed so it's better in that respect.
 
I remember people being more angry with the group responsible then with Sony.

lol hilarious, Valve is the group responsible this time!

And just because information may be out there. So what?

If a company can't be trusted to store people's data it is the company's fault for allowing the service and fucking it up.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another.

Bullshit. I said it to hlhbk and I'll say it to you: unless you were a victim of a previous breach, none of your information should be publicly available AND linked together in the manner of this breach.

There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites.

I agree to a certain extent. But Steam account information is meant to be private. People input data differently when it's public versus private.

I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place.

I half agree. People should protect their data. However, that does not mean the victim is at fault for assuming a service wouldn't fall apart like this.

There wasn't this sort of backlash when Sony was hacked.

Incorrect.
 
hlhbk
Banned
(Today, 12:04 PM)

Thought so.
Heh, it's always the people who victim blame harassment victims who have the weakest mental fortitude. Surprised he even tried to address you with a feeble "no" instead of running off.

Valve is absolutely terrible at anything and everything involving community, they really should at the very least outsource customer service and Steam support if having dedicated teams will ruin their culture.

Libertarianism once again shown to not be a wise paradigm on a large scale - it can be effective for creative work and allow new ideas to flourish, but when security is concerned there must be some architectural framework in place. I fail to see why Valve can't have both its laissez-faire attitude towards creative work and still have competent and organized Steam support from another branch.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.

You should be fine, the issue appears to be fixed. The only cached information currently showing up are caches on other sites when the issue first happened. If I'm not mistaken.
Then don't give me the option to store my information on your servers.

No, if you're accepting my data then you better make sure it doesn't leak. It's not my fault if you can't store it securely after you offered to do it.
 
For the record, I blame Valve for what has happened.

However I think people should try to learn from this experience. Hacks, mistakes and errors leading to leaks will always happen. It won't go away. Don't expect services to be 100% secure. We can all point fingers and grab our pitchforks, but the damage has still been done. Now again, blame Valve, but please be aware of risks in the future.

But what are we meant to do about it? We can do jack shit. Valve, PSN, XBoxLive etc etc, all want you to put your personal info onto your accounts so we are able to play games. How else can we lower the risks, we can't. The only people that can lower the risks and the only people to blame are the companies who want all our info.
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.
 
Even though you don't seem to doing the silly "consumer's fault too" thing other posters are, I want to clear something up.

Awareness of the risk doesn't impose any fault on the consumer. Valve created a digital storefront whose entire business model revolved around impulse purchases and continual, systemic transactions. They want, above all else, to have the CC information and file and do everything to facilitate that. Yes, obviously, there is always a remote risk of a privacy breach - but the fault lies entirely on the company. They have both a moral and legal obligation to protect the consumer, not the other way around.

So, even though we knew this kind of this abstractly could happen, it in no way softens the blow or shifts the blame.

Absolutely, I agree. I'm not trying to soften the blow or shift the blame. I'm talking about people learning to not trust services in the future, because there will always be leaks. Perhaps not saving their CC to their account, and similar things if possible.
 
I remember people being more angry with the group responsible then with Sony.

Let's take a guess at who is responsible this time shall we... it's not that hard to figure out.

And I'm not sure you were around for the Sony hacks, but it absolutely blew up in their faces. For weeks. If anything people are angry that Valve has made no statement or recommendation, and as it went with some previous bad experiences, will most likely try to shrug it off like nothing happened.
 
Like previous posters have pointed out your name, address & telephone are more then likely already publicly available in some form or another. There is a knee-jerk reaction when these sort of things happen, yet we continue to voluntarily share our personal information on our favorite social networking sites. I sympathizes with people who have their CC information saved to their account, but it really shouldn't be there in the first place. There wasn't this sort of backlash when Sony was hacked.

You should be fine, the issue appears to be fixed. The only cached information currently showing up are caches on other sites when the issue first happened. If I'm not mistaken.

Are you sure?
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.

The former, as it led to the latter and continues to rely on them rather than afford actual customer service.
 
There wasn't this sort of backlash when Sony was hacked.

Initially, Sony handled the breach very poorly. After the huge backlash from fans and international media, it went to great lengths to reduce the risk of it happening ever again. Sony's executives pubicly apologized in Japanese fashion and the company hired a top-tier security firm to improve their infrastructure. This event is not as catastropic as Sony's, but Valve sure could learn a thing or two from Sony's eventual response.
 
Really it's not that serious and I don't get why people are freaking out over this. As I posted before wether you realize it or not your full name, address, phone number, and email address are freely available online if you know where to look. The main alarming thing is any part of the credit card being available.

That being said it's a risk you are accepting by opting to save your payment information on retailers servers. I have been a part of many sites that have been breached, and at this point you need to realize it's not if but when this will happen to you.

As a Steam user since it was in beta in 2004 and have over 700 games in my library this won't effect my use of the service one bit.
That security breaches have become normal does not lessen their seriousness or the legitimacy of the outrage by customers who expect, and rightfully so, better and higher standards of security for a digital service that many have put thousands of dollars into. If basic security can't maintain payment info without breaches, then the standard should be that no payment info should be stored whatsoever.

As for personal info, name/location/phone, it still surprises me to see comments like yours that dismiss concerns about that info being freely available. It shouldn't be. People who think it shouldn't aren't freakish luddites, expectations regarding privacy used to be the norm. People used to have higher expectations. Not everyone is a follower of the idiotic Mark "Privacy is dead and no longer a social norm" Zuckerberg mindset.

As for me, I have been a Steam user for almost 10 years, I have over 3000 games in my library, and this WILL affect my usage of Steam. I have a lower expectation for security on Steam now. I will avoid using my CC on Steam and will probably switch to getting Steam Wallet cards from out of state, to avoid WA taxes. This breach, and the pathetic response from Valve, creates more trust issues regarding Valve. They may be wonderful to work for, as a customer though it feels as if they are merely treading down a well worn path of mediocrity and apparent indifference towards us all.
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.

+1
 
Valve has found a paradigm for development that is wonderful for creativity, originality, and allowing passion to show through. But as usual, there's no one-size fits all paradigm, and their attitude towards development does not translate well to security, community management, and customer support.

It seems entirely reasonable to me that the support side of Steam could organize itself more efficiently to actually function properly without stifling the more creative work of programmers.
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.

Both are shit in respects to this.
 
But what are we meant to do about it? We can do jack shit. Valve, PSN, XBoxLive etc etc, all want you to put your personal info onto your accounts so we are able to play games. How else can we lower the risks, we can't. The only people that can lower the risks and the only people to blame are the companies who want all our info.

Microsoft and Sony don't have a whole lot of information about me. They have an email address, which are easy to create as throwaway accounts. I'll never give them a credit card; I'll buy PSN and MS Point cards from retail stores (or Amazon if I'm lazy). Everything else they ask for (is there much else?) can be falsified.

Same goes for Valve.
 
Valve has found a paradigm for development that is wonderful for creativity, originality, and allowing passion to show through. But as usual, there's no one-size fits all paradigm, and their attitude towards development does not translate well to security, community management, and customer support.

It seems entirely reasonable to me that the support side of Steam could organize itself more efficiently to actually function properly without stifling the more creative work of programmers.
Steam's interface, friends, and community structure has been the same for a while and still is lacking in my opinion.
 
I have a question related to this. I don't save any purchasing methods on my accounts and that include my steam account. Is it only saved methods that were available or was there also previous ones stolen?
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.
Both defence force and lynch mob are rubbish.
 
Valve has found a paradigm for development that is wonderful for creativity, originality, and allowing passion to show through. But as usual, there's no one-size fits all paradigm, and their attitude towards development does not translate well to security, community management, and customer support.

It seems entirely reasonable to me that the support side of Steam could organize itself more efficiently to actually function properly without stifling the more creative work of programmers.
What has Valve Corporation developed lately other than hats and Steam cards?
 
I don't know what's worse, Valve's continuing lack of communication after close enough to 24hrs, or the number of people willing to go to bat for this multi-billion-dollar global corporation by insinuating people deserve to have their information stolen.

Fuck Valve, and fuck all of this victim blaming nonsense.

This.
 
Both defence force and lynch mob are rubbish.

I'd love to hear the compelling defense that turns back the mob.

As I can tell, they're isn't one. Not every issue has two equally valid sides, and when a multibillion dollar company can't even put out a coherent statement 24 hours after a major security breach the mob has the upper hand.
 
Initially, Sony handled the breach very poorly. After the huge backlash from fans and international media, it went to great lengths to reduce the risk of it happening ever again. Sony's executives pubicly apologized in Japanese fashion and the company hired a top-tier security firm to improve their infrastructure. This event is not as catastropic as Sony's, but Valve sure could learn a thing or two from Sony's eventual response.
I wouldn't hold my breath until Valve decides to go outside Valve to solve apparent problems...
 
Microsoft and Sony don't have a whole lot of information about me. They have an email address, which are easy to create as throwaway accounts. I'll never give them a credit card; I'll buy PSN and MS Point cards from retail stores (or Amazon if I'm lazy). Everything else they ask for (is there much else?) can be falsified.

Same goes for Valve.

Does Amazon have alot of your information? Do other companies? This is included in my etc etc. All we can do is make sure we have a hard password and not to use it for other accounts. The rest is up to the companies, in many cases if the company fucks up we have no way of lowering the risk.
 
Libertarianism once again shown to not be a wise paradigm on a large scale - it can be effective for creative work and allow new ideas to flourish, but when security is concerned there must be some architectural framework in place. I fail to see why Valve can't have both its laissez-faire attitude towards creative work and still have competent and organized Steam support from another branch.
I think you're seriously overestimating the Libertarian/ideological attitude of their setup. If they have some laissez-faire attitude, it doesn't seem to be producing bountiful harvests of game development or platform development. Their problem reeks of unwillingness to invest rather than a particular ideological orientation.
 
Top Bottom