Valve steampowered.com Valve (Steam) data breach: what happened and what to do
In November 2011 Valve said intruders reached the Steam forums on November 6 and then a Steam database holding usernames, hashed passwords, email and billing addresses and encrypted card data. Valve said it had no evidence the card data or personal information was taken.
View all 13,115 breaches- Breach date
- 6 Nov 2011
- Made public
- 10 Nov 2011
- Last updated
What happened
In early November 2011, Valve, the company behind Steam, found that its Steam forums had been hacked. The forum attack was on November 6. Valve's investigation then found that the intruders had also reached a separate database that supports Steam.
Gabe Newell, Valve's co-founder, told users about it on November 10. Valve later sent a follow-up email saying the investigation was still going with outside security experts. Valve reported the incident to the California Attorney General in early 2012. Valve never gave a total number of affected users in its notice.
What the database held
Valve said the database held user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. Valve also said it had no evidence that encrypted card numbers or personal information were taken, and no evidence the protections around passwords or cards had been broken.
That's worth reading carefully. Hashed and salted passwords are scrambled in a way that makes them hard to reverse, but weak passwords can still be guessed. And an email address and a purchase history are enough for convincing phishing that claims to be from Steam.
The company's response
Valve required Steam forum users to reset passwords at their next login and urged anyone who reused that password elsewhere to change it on those sites. It did not force a reset of main Steam account passwords, because it knew of no compromised accounts. Valve told users to watch their card statements.
What to do
This is an old breach, but the habits it points to still apply. The steps below cover them.
What to do if you were in it
- 1
Use a unique Steam password
If your Steam or forum password is one you use anywhere else, change it on both. A password manager creates and stores a different one for each site.
- 2
Turn on Steam Guard or another two-factor login
Two-factor login blocks most takeovers even when a password has leaked.
- 3
Watch your card statements
Valve's advice at the time was to monitor statements for unfamiliar charges. If a card was saved on Steam years ago, check it and consider replacing it.
- 4
Treat Steam-themed messages with suspicion
Emails about trades, bans or purchases that ask you to log in through a link can be phishing. Open Steam directly instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone number and tells you what to do next. Serus can't remove breach data, but it alerts you when your details show up.
Frequently asked
Was I affected by the Valve breach?
If you had a Steam account in November 2011, your data was in the database Valve said was reached. Valve said it had no evidence that it was taken.
What was in the Steam database?
User names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information, according to Valve's notice.
Were credit card numbers stolen?
Valve said it had no evidence that encrypted card numbers or personal information were taken or that the encryption was broken.
Should I change my Steam password?
Yes, if you reuse it anywhere. Use a unique password and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
