Christmas is becoming the season in which not a creature is stirring, except for hackers threatening to shut down the Playstation Network or Xbox Live. When our favorite gaming storefronts are up and free of dastardly hackers trying to ruin our fun, it seems like it’s only a matter of time until something drives a screw loose, and the season of buying cheap games you may never play comes tumbling down. Then, you have to hang out with family. The horror.
On Christmas Day something went very wrong with the Steam storefront. Essentially, it allowed users to access other people’s accounts at random. You could see their full account details, their Steam Wallet funds, cards to trade and more (possibly gifts). As scary as that is, knowing that private data is out there with predators looking to take advantage of the issue led to disconcerting tweets like this:
Do NOT attempt to unlink PayPal, remove your credit card details or anything else. Doing so will put you at risk instead.
— SteamDB (@SteamDB) December 25, 2015
And this:
Valve is having caching issues allowing users to view things such as account information of other users. Don't use Store for now.
— SteamDB (@SteamDB) December 25, 2015
Luckily, this issue was fixed within a day, but it raises plenty of questions about the security of your private data. Steam is an extremely easy store to buy from during the holidays. Link up your PayPal, and within a few clicks, you can have a new game installing on your computer. If this happened on what was likely their busiest day of the year, how much user information was possibly stolen due to users not seeing the above tweets?
Valve, the monolithic PC gaming company behind Steam and the upcoming Half Life 3, released this statement to Kotaku:
“As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users.”
It’s good to know that “no unauthorized actions” went down, but it’s still worrisome as cached information isn’t necessarily incorrect information when it comes to names and addresses. I didn’t log on to Steam during the outage (just because I was scared), but my friend was redirected to a Russian version of Steam for the afternoon, and his “Christmas” was essentially ruined after receiving a Steam Link as a gift.
Still, not being able to play is nothing when the possibility of your phone number and address are shown to random people.
At this point, since Valve suggests not changing your credit card or passwords we’re playing a new game that doesn’t even need a computer to run – a waiting game. Hopefully, more information will come soon.
(Via RockPaperShotgun & Kotaku)