Steam Hack More Severe Than Thought: Change Your Password NOW

[qubit]

Gabe Newell of Valve has issued a statement that the forum hack they experienced over the weekend actually goes much deeper than they thought. The criminals accessed the main database containing such goodies as user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. Apparently, no personally identifying information was taken - but we await the result of the full investigation before breathing a sigh of relief. Due to this serious breach, TechPowerUp advises all Steam users to change their account password immediately. People starting up their Steam client will now see the following message from Gabe Newell about this:

10 November 2011
Dear Steam Users and Steam Forum Users:

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn't be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

View at TechPowerUp Main Site

 

[ZakkWylde]

beat ya to it

http://www.techpowerup.com/forums/showthread.php?t=154945

 

[qubit]

beat ya to it

http://www.techpowerup.com/forums/showthread.php?t=154945

It was actually your post that alerted me to this, so thanks!

 

[ZakkWylde]

You're very welcome. I don't usually post news type stuff but this is major. I'm on a hardcore security/password strengthening spree. The more people that know the better!

 

[ViperXTR]

aligned to skyrim release? D:

 

[qubit]

Could this be the work of Anonymous?

 

[rcodi]

Seriously what the hell is wrong with kids. There is nothing remotely funny about this.

 

[hat]

Could this be the work of Anonymous?

I very highly doubt this.

 

[Wrigleyvillain]

Godamnit.

 

[qubit]

I very highly doubt this.

Why not? They attacked Sony, so they might well want to do the same with Steam.

Note that I don't have any evidence they did it, just saying that it's not that far fetched.

 

[shb-]

Yea, i guess this could be Anonymous, they were quite active lately. Maybe they found some child pr0n conspiracy going on in steam forums?
Yesterday they cracked my PC and deleted all my nude photos of myself, those anonymous guys are really gone mad. Shame i didnt create any backups.

Anyways i hope credit card data are crypted hard. If not, this will be huge fail for valve.

 

[Easy Rhino]

i wonder what bit algorithm they use for hash and salt. if it is SHA-256 or higher no fools are going to break it. unless of course they got their hands on the key...

 

[DonInKansas]

I just wonder how they'll get the passwords and in. Anytime I try to login from a different place I have to go through verification via email.

 

[AsRock]

Contradiction at it's best ?.

passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken

Something my wife bitching on about lol.
If they were hacked how you know this is not a hacker and secondly why wouldn't some thing this be signed manager or some thing and not just Gabe ?.

And just lets say if this was the hacker asking you change your password that he would know your password because you just changed it.

 

[[H]@RD5TUFF]

Their systems must be being pounded hard cuz it will not let me change my PW.

 

[kid41212003]

Oh shit i logged off now i can't remember the passwords...

I don't even remember the security answer to do forgot passwords..

 

[digibucc]

Contradiction at it's best ?.

credit card information can mean billing address, expiration, issuer, security code - but not necessarily card number.

Oh shit i logged off now i can't remember the passwords...

I don't even remember the security answer to do forgot passwords..

ouch

 

[Mindweaver]

Here is what i got when just logged into steam.

Thanks Qubit!

 

[HossHuge]

It took a long time to log in. I'm guessing many people are changing their passwords right now. I don't use a credit card on my computer so I'm not worried but I changed my password anyways. It had been the same since the first time I used Steam so it was time for a change anyways.

 

[ViperXTR]

Yesterday they cracked my PC and deleted all my nude photos of myself, those anonymous guys are really gone mad. Shame i didnt create any backups.

Wow, Heroes really do exist.

 

[[H]@RD5TUFF]

Canceling my credit card, this is really irritating!

 

[qubit]

Here is what i got when just logged into steam.

http://img.techpowerup.org/111110/SteamHacked.jpg

Thanks Qubit!

A screenshot!

 

[Solaris17]

I wonder what gabes steam game list looks like.

 

[xBruce88x]

password changed...

Steam Authenticator anyone?

 

[CDdude55]

I just deleted my Debit card number on Steam just to feel a little safer.