Steam Users' Credit Cards and Other Information Accessed in Database Hack

Steam recently admitted that its forums suffered a security breach, but the problem runs much deeper unfortunately. Steam users' accounts have been compromised, as the entire database, including credit card data, was accessed. IndustryGamers just received the following letter from Valve's Gabe Newell:

[donniebaseball]

WOW. This is not good. Sony knows their pain. Stupid hackers.

[StayStatic]

Indeed , will probably never here the end of this now.

[ABizzel1]

All hackers should executed. Recently hackers hacked over 4 million people a organizations including governments across the globe. Start whacking them off, and I'm sure we'll see a decline of the activity.

[MaximusPrime]

Every companies are not safe. I feel for those Steam members

[Altourus]

FFS my bank just sent me a new credit card number because of the Sony hack.

[dead_eye]

get a new bank cos that took fucking ages

[Abriael]

gabe's mail was NOT very clear. First he says both forums and steam itself were hacked. Then he says just the forums. What the hell?

[TheIneffableBob]

No, he said that both the Steam forums and a Steam database were compromised. Encrypted info was taken but they cannot confirm if that encrypted info was cracked or not (very unlikely to be cracked since the encryption is very strong). Also, with Steam Guard in place, to even get access to your Steam account would require that the hackers also gain access to your e-mail. They would have to crack the encrypted passwords which would take a long time, then they would have to hope that that password is the same as your e-mail password, and if it isn't then they would have to find that.

Basically, I wouldn't worry too much about your accounts being in jeopardy or whatever. It's unlikely for anything to happen.

Gabe did confirm that a couple forum accounts were compromised, however, which means that the hackers were able to get the username and passwords of forums accounts and log in with them.

[Ocelot525]

"(very unlikely to be cracked since the encryption is very strong)"

1. Everything can be decrypted with brute force. It only takes some time.

2. the passwords were not encrypted, they were hashed , big difference.
Many forums have the passwords hashed in MD5, which can be unhashed in mere seconds trough a flaw in that algorithm which was only discovered recently.

The industry is moving towards the SHA-algorithm for hashing passwords, but most forums still use MD5 because It's too much work too change.

source: me , I develop web-applications

[TheIneffableBob]

Rereading the message, it doesn't look like it says anything about how the forum passwords were protected, but the database Steam account passwords were hashed and salted which makes them nigh impossible to crack assuming the protection used is strong enough. It could be cracked with brute force but it would take an unreasonably long time. I'm gonna assume that the protection used on the credit card info is even stronger.

[Cosmit]

Oh crap. I have my info on there! >:[

[nightmarex121]

Damn that sucks

[Shackdaddy836]

This is why I un-check that little box that says "save credit card info" when buying things

[SKUD]

Wither your shopping on or offline keeping tabs on your credit report / banks statements are very important. Report anything that looks suspicious. Its the only real way to protect yourself. Don't rely on ANY website to protect your data.

[solar]

monitor all your stuff kiddies. im changing my pw now for Steam and hope everyone does the same.

[OC_MurphysLaw]

Man, this has to be such a gut shot to Valve. They were riding such a high wave, Steam was looking unstoppable...hopefully they caught on in time but I fear this is going to blow up more.

[Sarobi]

Great.. now as punishment they'll delay HL3 even longer.

[JsonHenry]

Well, changed my password and hoping they didn't/can't break the encryption for my credit card info.

[Satish13]

is it bad that I lolled when i read the title? it just so happens i don't use a credit card with my PS3 and dodged that bullet a while ago, but I also don't use one with Steam, I just didn't see Steam as a target. well this'll be interesting.

[Ddouble]

Something tells me the reactions to this will be far different to that of when Sony got hacked.

Still lets focus the blame on the hackers themselves.

[BrianC6234]

Wait, didn't this story first pop up a couple weeks ago? If so I think Sony was much quicker at letting their customers know what happened.

[Bladesfist]

nope happened a few days ago

[maniacmayhem]

That sucks...

You know its better to have a secured credit card up to say just 200 bux and just use this for gaming across all platforms.

Anyways, i hate to hear when this happens.

[Organization XII]

yeah mine i limit it to 100 bucks and i never keep the info saved. oh well

[jeezuz]

how do you change your steam username and password? sorry about the noob question I've just never done it before

[yesmynameissumo]

Using the Steam client: View->Settings->Change Password or Secret question.

If you do it via the website, login and click My Account.

[Shackdaddy836]

Go to the main steam page

Click on the "Steam"button on the top left corner. This should open up a drop down menu

Then select "settings". This should open up a separate settings window.

Click the "change password or secret question..." button in the account tab.

[Bladesfist]

On the steam client. Go to Steam > Settings > Change Password. Hope I helped, Darn hackers

[Emilio_Estevez]

That is not good.

[Moragami]

It was Origin. Everybody knows that Origin is Steam's evil twin.

[Megaton]

lol @ "IndustryGamers just received the following letter from Valve's Gabe Newell". You make it sound so hush hush insider.

Everyone logging into Steam "just received the following letter from Valve's Gabe Newell".

[GraveLord]

No one is safe from hackers.
Is Microsofts Xbox Live next?

[rattletop]

that's bad. but anyhow i haven't bought anything from steam yet, cos i prefer disc.

[Somebody]

This is why permanent online DRM is a bad idea.

Online accounts are too susceptible to attacks no matter what security measure they use. A good balance of online support with offline play is the key. Anchoring a whole game to an online connection is just asking for trouble. The moment a server is attacked/ or shut down for maintenance, gamers can't play the singleplayer. The more damage done, the longer the gamers suffer.

Look at Steam. It's under attack but I'm still able to play games with it's offline mode (I keep them offline all the time, going online every week to get updates only- as if anticipating this attack). Wonder how Diablo 3 and STALKER 2 will perform if their servers are attacked. Sure they can add better system but that usually means additional cost will be added.

[just_looken]

The forums now just have the message nothing else fuck i heard of this attack but never knew it was this bad.
http://forums.steamgames.co...

Ill be changing my details asap.