Please support Game Informer. Print magazine subscriptions are less than $2 per issue

X
PSA

[Update] Valve Says 'No Unauthorized Actions' Were Enabled On Improperly Viewed Steam Accounts

by Mike Futter on Dec 25, 2015 at 01:32 PM

Heads up, friends. Readers have reported and Game Informer can confirm that there is a security problem on Steam right now.

You might find that you can see libraries belonging to other people. More importantly, if you attempt to access your account details, you’ll see data for other users.

We’ve reached out to Valve for details. Without a way to access your own account information, it doesn’t appear you can change anything (including stored payment information). It also doesn't appear that any existing protocols you might have in place, like an authenticator or other two-step verification will prevent this from happening.

Update 1: Valve appears to have pulled the plug on the entire Steam service for the time being. We strongly urge you to suspend all activity until there's an official all-clear (whether directly from Valve or via a statement to Game Informer or another reputable outlet).

Update 2: Steam is back online. A community moderator has posted and pinned the following statement, but the individual is not a Valve employee. This update has been corrected. The text of the unofficial statement is below for reference.

Account information incorrect

We've gotten reports that people sometimes see other people's account information on the account page. Valve has been made aware of this and are working on a fix.

Some frequently asked questions:

- No, Steam is not hacked

- Creditcard info and phone numbers are, as required by law, censored and not visible to users

Update 3: We are amending and correcting our most recent update. The statement above was posted by a community moderator and not a Valve employee. We regret the error and will continue to monitor the situation.

Update 4 (Final): Valve has responded to our request for comment, sounding the all-clear and assuaging concern over account compromise. The company says that all systems have been restored, and a caching issue caused users to see account details that weren't their own. No further action is required from users, according to a Valve representative.

"Steam is back up and running without any known issues," we were told via email. "As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users."