Thursday, November 10th 2011

Steam Hack More Severe Than Thought: Change Your Password NOW

Gabe Newell of Valve has issued a statement that the forum hack they experienced over the weekend actually goes much deeper than they thought. The criminals accessed the main database containing such goodies as user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. Apparently, no personally identifying information was taken - but we await the result of the full investigation before breathing a sigh of relief. Due to this serious breach, TechPowerUp advises all Steam users to change their account password immediately. People starting up their Steam client will now see the following message from Gabe Newell about this:

10 November 2011
Dear Steam Users and Steam Forum Users:

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.
Add your own comment

127 Comments on Steam Hack More Severe Than Thought: Change Your Password NOW

#3
ZakkWylde
You're very welcome. I don't usually post news type stuff but this is major. I'm on a hardcore security/password strengthening spree. The more people that know the better!
Posted on Reply
#4
ViperXTR
aligned to skyrim release? D:
Posted on Reply
#5
qubit
Overclocked quantum bit
Could this be the work of Anonymous?
Posted on Reply
#6
ColdRush
Seriously what the hell is wrong with kids. There is nothing remotely funny about this.
Posted on Reply
#7
hat
Maximum Overclocker
by: qubit
Could this be the work of Anonymous?
I very highly doubt this.
Posted on Reply
#9
qubit
Overclocked quantum bit
by: hat
I very highly doubt this.
Why not? They attacked Sony, so they might well want to do the same with Steam.

Note that I don't have any evidence they did it, just saying that it's not that far fetched.
Posted on Reply
#10
shb-
Yea, i guess this could be Anonymous, they were quite active lately. Maybe they found some child pr0n conspiracy going on in steam forums?
Yesterday they cracked my PC and deleted all my nude photos of myself, those anonymous guys are really gone mad. Shame i didnt create any backups.

Anyways i hope credit card data are crypted hard. If not, this will be huge fail for valve.
Posted on Reply
#11
Easy Rhino
Linux Advocate
i wonder what bit algorithm they use for hash and salt. if it is SHA-256 or higher no fools are going to break it. unless of course they got their hands on the key...
Posted on Reply
#12
DonInKansas
I just wonder how they'll get the passwords and in. Anytime I try to login from a different place I have to go through verification via email.
Posted on Reply
#13
AsRock
TPU addict
Contradiction at it's best ?.
passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken
Something my wife bitching on about lol.
If they were hacked how you know this is not a hacker and secondly why wouldn't some thing this be signed manager or some thing and not just Gabe ?.

And just lets say if this was the hacker asking you change your password that he would know your password because you just changed it.
Posted on Reply
#14
[H]@RD5TUFF
Their systems must be being pounded hard cuz it will not let me change my PW.:banghead:
Posted on Reply
#15
kid41212003
Oh shit i logged off now i can't remember the passwords...

I don't even remember the security answer to do forgot passwords.:laugh:.
Posted on Reply
#16
digibucc
by: AsRock
Contradiction at it's best ?.
credit card information can mean billing address, expiration, issuer, security code - but not necessarily card number.
by: kid41212003
Oh shit i logged off now i can't remember the passwords...

I don't even remember the security answer to do forgot passwords.:laugh:.
ouch
Posted on Reply
#17
Mindweaver
Moderato®™
Here is what i got when just logged into steam.



Thanks Qubit!
Posted on Reply
#18
HossHuge
It took a long time to log in. I'm guessing many people are changing their passwords right now. I don't use a credit card on my computer so I'm not worried but I changed my password anyways. It had been the same since the first time I used Steam so it was time for a change anyways.
Posted on Reply
#19
ViperXTR
Yesterday they cracked my PC and deleted all my nude photos of myself, those anonymous guys are really gone mad. Shame i didnt create any backups.
Wow, Heroes really do exist.
Posted on Reply
#20
[H]@RD5TUFF
Canceling my credit card, this is really irritating! :banghead:
Posted on Reply
#22
Solaris17
Creator Solaris Utility DVD
I wonder what gabes steam game list looks like.
Posted on Reply
#23
xBruce88x
password changed...

Steam Authenticator anyone?
Posted on Reply
#24
CDdude55
Crazy 4 TPU!!!
I just deleted my Debit card number on Steam just to feel a little safer.
Posted on Reply
#25
qubit
Overclocked quantum bit
by: Solaris17
I wonder what gabes steam game list looks like.
Oh, his has every single game and DLC in the catalogue. There are completely unrestricted accounts like that floating about, trust me.
Posted on Reply
Add your own comment