Steam Hacked

[Wing Commander MAD]

Link.

Steam Hacked, Valve Investigating Possible Credit Card Theft


A message sent just now from Valve Corporation head Gabe Newell says credit card numbers and other personal information were inside a database compromised during a defacement attack on the Steam forums this Sunday.

Valve is advising all of its Steam customers to keep close eye on their credit card activity, as those numbers were inside a database the hackers penetrated during the larger attack, Newell wrote. The Steam Forums are currently closed. Steam itself is operating.

"We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating," Newell wrote. "We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely."

The database exposed during the attack "contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information," Newell said in the statement.

The Steam Forums are currently offline as Valve continues its investigation and recovers from the attack. When the forums return, all users will be required to change their passwords. Users who used the same password on the Steam Forums as they did on other sites are advised to change those passwords as well.

"We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn't be a bad idea to change that as well, especially if it is the same as your Steam forum account password." Newell wrote.

"I am truly sorry this happened, and I apologize for the inconvenience," he said.

Just a simple heads up, I just got made aware of this. Changing the password and secret question information you use for the Steam client would be prudent, though is not currently required. Hopefully, there aren't any disruptions of service as a result.

[Darksider]

Well it appears Steam took my instruction to not save my credit card info as a fucking suggestion rather than an order, so i'll have to keep watch on my credit card for a while. I am officially done buying steam products for the forseeable future.

[KhorneFlakes]

I've already changed all my passwords, but the goddamn Steam website won't let me change my password for steam. And the program is working either for some stupid reason. Whoop-de-fucking-doo.

They said it was the forums they were shutting down. Not the client.

[weemadando]

I think their password change is just getting hammered.

[Zixinus]

What I'd like to know is how does hacking a forum get you access to the Steam's user database.

[weemadando]

I'd guess that they're being over cautious and saying: "well, they got into X part of our systems and Y part is connected to that and there's a chance that they might have looked into it, even though we aren't sure yet."

[Sharp-kun]

What I'd like to know is how does hacking a forum get you access to the Steam's user database.

Not what they said. They were investigating the forums being defaced and while doing that discovered the database intrusion. Doesn't follow that one was due to the other.

I'm not that fussed. I've changed my password just in case but from what they've said everything was properly encrypted anyway.

[Zixinus]

Am I the only one that can't change their password?

[Dread Not]

Fuck me if gaming hasn't become the most frustrating hobby out there these days. Not that anyone should need any of this shit explained to them, but Jim Sterling said it pretty well in his episode of the Jimquisition on this sort of subject. As if the PSN hacking scandal wasn't bad enough, now Steam has suffered the same fate. I actually like Steam, and think it's one of the few digital distribution systems that provide a decent service at a good value. But no bargain is worth the anxiety of having your personal details stolen. If I wasn't already dead set against Origin, this would have been more than enough for me to say "Fuck this noise." There's no way I trust EA to do this shit right more than Valve. This sort of push in gaming over just the last couple of years has caused me to buy significantly fewer games, and I'm about as much of a gaming fanatic one can be while still having a sex life.

[Dread Not]

Well it appears Steam took my instruction to not save my credit card info as a fucking suggestion rather than an order, so i'll have to keep watch on my credit card for a while. I am officially done buying steam products for the forseeable future.

As I recall I didn't have my credit card info saved either, but I can't figure out how to confirm it. How did you find this out?

[Sharp-kun]

But no bargain is worth the anxiety of having your personal details stolen.

Tbh, its not worth fretting about. My view on these things is:

1) I'm 1 out of X million. Chances of my details being the ones chosen to be used are small, though shit happens.

2) In Steam's case, all the data is apparently encrypted. Hackers getting the data is meaningless if they can't get into it.

3) My Steam password is unique. They can't use it to get into other accounts. Not even my Steam one given I've changed the password since.

4) They could maybe try to use my email address to get into stuff, but those accounts that use it are also pretty secure.

5) If they somehow did get my CC details, I'll notice.


I might just be super laid back about these things, but life's too short to get stressed. Its a risk you take every time you use a debit card - one of my mates got his card skimmed in Costa last time he was in London and got charges racked up. Life goes on.

[Rightous Fist Of Heaven]

Started using Steam more only a month or so back and purchased some crap through there. Seeing as to how I'm a bit overly paranoid over my personal information at times, how worried should I be about my credit card information ending up in the wrong hands as a result of this? I understand it's more or less impossible for the hackers to crack the encryption on the CC details if they dont have the encryption key.

[Dread Not]

I might just be super laid back about these things, but life's too short to get stressed. Its a risk you take every time you use a debit card - one of my mates got his card skimmed in Costa last time he was in London and got charges racked up. Life goes on.

If I gave the impression that I'm going to be losing sleep over this then I chose my words badly. But if I don't have confidence in a service, I'm simply not going to invest my time and money into it.

Like I said, I like Steam, and honestly if this is just a one-off occurrence then I will probably continue using it. But this is just the latest in a long line of annoyances thanks to the industry's push towards digital distribution, which is why I linked to the video. Just recently with Batman: Arkham City, people were having all sorts of problems redeeming their pre-order content, and the bonuses were a labyrinthine mess to begin with. I'm fed up with changing passwords, inputting codes, and having to do all sorts of research to know how much extra money I'll need to shell out on DLC, what I'm missing out on if I don't pre-order, what kind of bullshit DRM I'll have to worry about infecting my PC with, or whether the game has an online pass etc.

Now Steam at least allows me to buy quality games with the change I dig out of my couch, so I can be more forgiving for this fuck-up, since the service actually serves a purpose. The other things I mentioned bring little to nothing to the table that I can see, which makes the negative consequences of them taste all the more bitter.

[PeZook]

I find it AWESOME how difficult it is to actually change your password with Steam, though. Seriously, every time I forget how horrible Steam is about usability, I get a brutal reminder.

[Edward Yee]

Oddly enough, I just changed my password and secret question from the client with no drama or hang-ups.

[PeZook]

Oddly enough, I just changed my password and secret question from the client with no drama or hang-ups.

It's the fact you need to fire up the client that I find terrible. I can give them my money through the website, but doing basic things like changing your password? No, go home and fire up the client!

[Guardsman Bass]

I changed my password. I'm just grateful that I didn't have any credit card information stored on site.

[Edward Yee]

Whereas in my case the card had to be canceled and replaced, albeit I've been so out of the loop that all of this (both the Steam hack and the card cancellation/replacement) happened without my knowledge.

In light of this though, I haven't and may not put the new card onto Steam.