16 replies to this topic

[Janichsan]

Some might have noticed that the Steam forums were offline for a couple of days already, after they had been hacked. But apparently, the problem runs deeper and is close to what PSN users experienced earlier this year: it seems that the hackers also obtained access to...

Quote

user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information.

Valve suggests keeping a close eye on your credit card statements and changing your passwords.

Here's the full statement:

Quote

Dear Steam Users and Steam Forum Users:

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

[Thain Esh Kelch]

I'll keep a lookout on my VISA.

[Frigidman]

Geez.

[the Battle Cat]

Thanks for the heads up.

Edit: OK I give up.  Where the frak do you change your password on steam?  Nothing in my profile or account either in Steam or a web browser.  It shouldn't be difficult but it is.

[Matt Diamond]

Battle Cat: the password change function is under the Mac menu, View->Preferences, Account tab. Took me a few tries to find it, thanks to their schizo interface.

Where are people getting this announcement from? I didn't get an email, and I logged in just now and didn't see anything. Wish they'd made more of an effort to get the word out.

[Sneaky Snake]

I wish hacker's would hack into the student loan's office and erase my debt

[the Battle Cat]

Thanks Matt.  I finally found it but was still too pissed off to come back and post it.  Their support was absolutely of no help.  I found how to change your password there but it applied only to PCs and had no similarity to the Mac solution.  Of all the dumb assed places to put the password change dialog.  I absolutely hate bad user interface and this example is as bad as you could get.  Straight from the planet Mongo.

[Janichsan]

Matt Diamond, on 11 November 2011 - 10:42 AM, said:

Where are people getting this announcement from? I didn't get an email, and I logged in just now and didn't see anything. Wish they'd made more of an effort to get the word out.

Allegedly, some Steam customers got this via email. I didn't (yet?) – I just stumbled upon it when trying to check the Steam forums. That's definitely something that should be on the Steam starting page.

[Kilvain]

According to the email we received at IMG the message was going to be "IM'd to the Steam user base." It makes little sense that it isn't on the starting page.

[Sargiel]

I did get this as a pop up notification when I loaded steam today. I've duly changed my password and will keep my eyes peeled. Not good to see security breaches though .. Wouldn't be surprised if they had my card details from prior purchases etc.

[Smoke_Tetsu]

Yeah, no it wasn't IM'ed to the steam user base it was sent as a news update that pops up when you launch steam.

I'd be suspicious of if it I got it over IM.

[Tacohead]

the Battle Cat, on 11 November 2011 - 01:42 PM, said:

Thanks Matt.  I finally found it but was still too pissed off to come back and post it.  Their support was absolutely of no help.  I found how to change your password there but it applied only to PCs and had no similarity to the Mac solution.  Of all the dumb assed places to put the password change dialog.  I absolutely hate bad user interface and this example is as bad as you could get.  Straight from the planet Mongo.

I couldn't find it either until I dug deep into Steam's support pages. How silly!

-PN

[bobbob]

Make sure to enable Steam guard, while you're at it, so that they email you with a confirmation code anytime someone tries something with your account.

[The Liberator]

bobbob, on 11 November 2011 - 07:28 PM, said:

Make sure to enable Steam guard, while you're at it, so that they email you with a confirmation code anytime someone tries something with your account.

Yeah, I enabled it a while back, and I am very thankful I did.

I think I'll change my forums password…and maybe all my Steam passwords at that.

Liberator..

[Matt Diamond]

FWIW I finally did get a pop up notification about it when I reran Steam later in the day. Glad to see that they are indeed serious about getting the word out.

[DaveyJJ]

The Liberator, on 11 November 2011 - 07:50 PM, said:

Yeah, I enabled it a while back, and I am very thankful I did.

I think I'll change my forums password…and maybe all my Steam passwords at that.

Liberator..

I use "Liberator" as my password, most places, but don't tell anyone.

[The Liberator]

DaveyJJ, on 12 November 2011 - 11:24 AM, said:

I use "Liberator" as my password, most places, but don't tell anyone.

Hahaha.

Lib.