Steam Down After Security Error Exposes Personal Information

Popular PC game digital distribution service Steam is offline. This comes after a security flaw exposed personal information of its users.

(Update: Steam Back Online, Valve Says 'Caching Issue')

Those who logged into Steam were greeted with account details of other users rather than their own. These included full names and addresses as well as credit card numbers and the amount of funds present in the Steam wallet.

While no new purchases could be made nor account details be modified, the information visible could be used to compromise other services.

(Also see: I Have Over 300 Games on Steam and I'm Leaving It All Behind for GOG Galaxy)

At the time of writing this, the Steam website is offline. The service can still be accessed via its PC client but the store section cannot be viewed through it either.

The error message we received when trying to access Steam's website.

(Also see: Valve Implements Steam Trading Holds as Anti-Hacking Measure)

According to a discussion on Reddit, this is probably due to misconfigured or failing cache server.

"My guess to how this could've happened is that an untested configuration got activated when steam went down earlier, e.g. due to an auto-cont service (puppet, chef) pulling an untested config or some of their live servers being replaced by staging / development servers. It's also possible that they were under heavy load and the engineer on duty reconfigured all their edge nodes to cache more aggressively," said Redditor ARoyaleWithCheese.

"Let's hope they fix this fast, because this is a major data leak. I can see private E-Mail and account names. Let's hope their cache server is not delivering internal pages."

According to a moderator on Steam, Valve knows of this problem and is working on a fix. Further adding that the service has not been hacked and personal information as required by law is censored and not visible to other users. It's at odds with community reports of being able to view user details.

However, whether this is due to an oversight on Valve's part or something more sinister is yet to be ascertained. Valve itself has yet to comment on the issue. Steam's support desk is offline as well. At this point in time we would highly recommend staying off Steam until Valve officially breaks silence on the matter.