Gabe Newell Wrote:Dear Steam Users and Steam Forum Users,

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

Quote:Today Valve told us that their cloud-based Steam service has been compromised, and that users' personal information and credit card information could be at risk.

Here are some common questions we've been getting, and the best answers we can provide given what we know. We are monitoring the situation and have reached out to Valve for more information. We'll update as we learn more.

Wait, Valve Was Hacked?

Steam, specifically. Here's what we know.

Is my credit card compromised?

Valve isn't sure. According to the email we received, the hackers gained access to a database that included user names, hashed and salted passwords, game purchases, email addresses, billing addresses, and yes, encrypted credit card information.

Valve does not have evidence that the encrypted credit card numbers or personal information were actually taken by intruders, nor that the intruders have the means to crack the encryption. Valve reports that they don't have any evidence of credit card misuse at this time and are "still investigating."

When did Valve know about this?

Valve started investigating after their forums were defaced this past Sunday, November 6th. It's unclear when exactly they realized that the intruders had also gained access to a Steam database.

Who is responsible?

No one knows, and no one has claimed responsibility. It is suspected that a site called Fkn0wned.com had something to do with Sunday's forum defacement.

Should I change my Steam Password?

It couldn't hurt, might as well take this opportunity to change your Steam password. It's really simple—on PC, open Steam and go to "Settings" in the "Steam" menu up top (It's called "Preferences" on Mac). Your account information can be easily changed under the "Accounts" tab.

Should I reset all of my passwords?

This also couldn't hurt, though it's time consuming. An easy way around this (since surely this won't be the last time one of your services gets hacked) is to get a program like 1Password or lastpass and use those to regularly change all of your passwords.

How can I reset which computers can access my Steam account?

Similar to changing your password, go into the "Settings" menu ("Preferences" on Mac) and access the "Accounts" tab. Click "Manage Steam Guard Account Security" and select the option to deauthorize all computers now. Then, reauthorize your computers one by one.

Are we gonna get free games because of this?

Well, there's usually some sort of "make good" after this kind of thing happens. Sony gave away a few games after they got hacked, so it stands to reason that Valve will do something similar. That or just give everyone some rad hats.

Who cares about my credit cards and passwords. Will Skyrim still unlock tonight?

Though the Steam forums are down, Steam itself is still working fine for all of us. So, you can relax: we don't anticipate a problem with Skyrim's launch.

Kalovale Wrote:Loving Steam and the transparency.

And damn is this dangerous. I almost punched through my screen reading the comments.
EDIT: Is it just me or is everything center-aligned? nevermind, zapped back to normal.

Quote:While the scope of the Steam Hack remains to be seen, for millions of gamers its early developments—indeed, even Valve's early statements—match those of this spring's notorious PlayStation Network outage, which may provide a guidepost for what is to come.

Earlier today, Valve confirmed that a database containing private information, including encrypted credit card information from its more than 35 million Steam customer, was exposed in a defacement attack on the Steam Forums this Sunday. The Seattle-based PC gaming giant says it has no information that any credit card numbers were stolen in the attack, but says it still is assessing the scope of the breach.

While Steam's 35 million accounts are less than half of the registered accounts affected by the 23-day PlayStation Network outage most, if not all of those, are attached to a single credit card. Many of the PlayStation Network accounts compromised in the April attack were duplicates, or even inactive, considering that PSN offers online multiplayer and PlayStation Store access for free. Indeed, when Sony announced that credit card information was caught in the PSN hack, it said roughly 12 million credit card accounts were potentially compromised.

The Steam Hack affects only the Steam Forums—the download service remains online for tomorrow's heavily anticipated release of The Elder Scrolls V: Skyrim. But in this case, it's more likely that the number of Steam accounts compromised is closer to the number of credit card accounts exposed, though it's unknown whether the compromised database was a comprehensive accounting of the Steam installation base, or only a portion of it.

Still, Valve has taken about as long as Sony to publicly declare the compromised information, doing so six days after the first signs of trouble. PlayStation Network was taken offline April 20; after an investigation, Sony announced April 26 that personal information, potentially credit card numbers, were exposed.

Sunday saw a defacement of the Steam Forums blamed on the hacking website Fkn0wned.com (it has not taken responsibility). After an investigation, Valve announced today that personal information, potentially credit card numbers, were exposed.

Valve's Statement today:

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

Sony's Statement on April 26:

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID. ... While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. ... Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

In the worst case scenario, what happens next will be influenced by Valve's size relative to Sony's. Though unquestionably the dominant download service among PC gamers, where PSN has a strong competitor in Xbox Live, Valve also isn't a company anywhere near the likes of Sony, with attendant friends and/or enemies in government. Console gaming scandals are also more likely to become the kind of consumer-protection issue that summoned Sony officials to Capitol Hill to explain the problem.

That said, just because Valve has enormous respect among the gaming population for its forthrightness on subjects like file-sharing and piracy, and is led by a respected developer who maintains a genuinely open-door relationship with video gamers, does not mean that today's announcement describes the size of the problem. And the Steam Forums remain offline.

If the past is any guide, we will likely discover more about the depth of this attack and the actual exposure in days to come. And then, like the PSN Hack, users will be reminded that no network is truly secure, and the price of participating in an open, connected society is eternal vigilance.

Locked Wrote:The information is hashed, salted, and encrypted. It's not that bad.

Sarah Wrote:Transparency? They've responded EXACTLY the same as Sony did. It's even taken around the same amount of time. Kotaku outlines it very nicely



http://kotaku.com/5858513/what-the-psn-outage-tells-us-about-the-steam-hack

Sarah Wrote:Transparency? They've responded EXACTLY the same as Sony did. It's even taken around the same amount of time. Kotaku outlines it very nicely



http://kotaku.com/5858513/what-the-psn-outage-tells-us-about-the-steam-hack

MissingLink Wrote:Maybe so, but they are far more open, honest and diligent than another online game company we know of.

Sarah Wrote:Transparency? They've responded EXACTLY the same as Sony did. It's even taken around the same amount of time. Kotaku outlines it very nicely