Skip to main content
The VergeThe Verge logo.The Verge homepage
The VergeThe Verge logo.

Valve on Steam's Christmas breach: 'We’re sorry'

Valve on Steam's Christmas breach: 'We’re sorry'

By Chris Plante / @plante

Share this story

In the middle of Steam's winter sale, roughly 34,000 users had personal information exposed to other users. The breach was unusual. According to Valve, a partner tried to counter a denial-of-service attack by deploying new caching rules, hoping to distinguish the malicious traffic from normal customer traffic. For many users, the change accidentally loaded a different person's information when attempting to sign into a Steam account.

Users couldn't make purchases or access credit card information on the other person's account, but they could see details like the person's e-mail address, purchase history, and billing addresses. Valve promised to notify anyone who had been affected with an explanation of the breach. That e-mail has finally been sent.

"We’re sorry this happened," says the communication from Valve, "and have taken steps to prevent this problem from occurring in the future." Let's hope so. Fearing your account has been hacked on Christmas Day is a gift nobody wants.

We've included the full e-mail, below.

Dear Steam User,

As you may know, for a brief period on December 25th, a configuration error resulted in some Steam users seeing incorrectly cached Steam Store pages generated for other Steam users. If you are not familiar with the issue, an overview of what happened is available at http://store.steampowered.com/news/19852/ .

If you accessed the Steam Store between 11:50 PST and 13:20 PST on December 25th, your account could have been affected by this issue. If you did not use the Steam Store during that time, your account was not affected.

Between the times above, a requested web page displayed during your Steam Store checkout process may have been incorrectly displayed to another Steam user in your local area. This page may have included billing information previously saved to complete future purchases including your full name, billing address and billing phone number. It may have also included the last two digits of a credit card number or a PayPal email address, if previously saved for future purchases. It did not include full credit card numbers, Steam account passwords, or other information that would allow another user to complete a transaction with your billing information.

We are contacting you because an IP address previously used by your account to access Steam made a web page request as described above. Because IP addresses are commonly shared for home networks, mobile devices and by internet providers, we are unable to verify that your account was actually the one that made this request. For example one affected IP address was previously used by over 1,700 Steam accounts. Consequently we are notifying all users who have previously used this IP address.

This event did not make it possible to compromise your Steam account or make a fraudulent transaction from your account, but we want you to be aware of what information could have been seen by another Steam user.

We're sorry this happened and have taken steps to prevent this problem from occurring in the future.

If you used the store between 11:50 PST and 13:20 PST on December 25th and you have questions please email cachingissue@steampowered.com.

- Valve

More from Gaming