Cybercafe card details stolen

No danger to other customers :: April 19th, 2007 :: Events, Valve :: 139 Responses

You may by now have heard that “Steam” was broken into a week and a half ago and “consumer” credit card details stolen. As the quote marks suggest the breach has been played up by those behind it, whose exaggerations have been somewhat naively passed on by a number of big sites today. In actuality:

Steam was not compromised, only a regular Valve file server. In fact according to Valve it was a “third-party site” — though what sort of third party stores the sum in their corporate account I don’t know.
Consumer credit card information has not been stolen. The numbers in danger are all held by cybercafe owners, who have recurring subscriptions to their Steam games and have probably all long been informed (or not?). Consumer data are only stored in enough detail to fight mass fraud, not make purchases, and weren’t compromised anyway. Paying at a cafe does not put your card at risk.

All this will certainly make sure that when consumer subscriptions do arrive (as they will with Pirates of the Burning Sea) they’ll be properly secured, but given that it isn’t really a Steam issue there’s not much more for me to talk about. If you see anyone worrying, send them here!

Update: Valve’s statement, from 1UP:

There has been no security breach of Steam. The alleged hacker gained access to a third-party site that Valve uses to manage the commercial partners in its Cyber Café program. This Cyber Café billing system is not connected to Steam. We are working with law enforcement agencies on this matter, and encourage anyone with more information to e-mail us at catch_a_thief@valvesoftware.com.

Tags: big stories, purchasing, security

139 Responses to this post:

Comments

April 23rd, 2007 at 6:37 am ::
george_bush_fr Says:

is there people who thinks that the hacker is “inside” valve corp ?
my idea is : one gained access to the “main pc” from the valve intranet . as steam has a lot of traffic with a huge number of ips : servers and players [ 1 mn stat for steam page_stats ] , same personn from valve hacked emporio website to declare the ccard … , nice try to fool the “police” on the bad road 8] ……..
May 6th, 2007 at 1:38 am ::
Al3xand3r Says:

Dur, even if you don’t know the exact content of the files it is very clear that they were aquired illegally and that the public isn’t meant to have them as they were provided as proof of the hack. Therefor, it was the smart thing to do, not providing a link to places that offer illegal content. On the other hand, it was also the smart thing to do, to inform people of the potential breach. I did the same thing on my site, though I explained myself thinking there may be people like you around Zips:
http://www.mod-hq.com/index.php?page=news&article=370

Also, I later found out they didn’t “pick 1UP” to unveil this, the message was posted on the steampowered forums, I only credited 1UP because it was the right thing to do as I saw it there first.

Sorry for being late to respond to this crap with my view, I love this site, I just don’t have that much time these days.
July 11th, 2008 at 11:41 am ::
Loyst Says:

I have buy game on steam. Is my credit card details stolen. Please pm to my email steam.
February 2nd, 2009 at 7:33 pm ::
Mike Says:

Thanks for the Info. Never looked at my cc
March 20th, 2009 at 5:51 pm ::
Tona Says:

Haha ^^ nice, is there a section to follow the RSS feed