Steam accounts/data breached... (updated)

[Fallen Kell]

Just a FYI, it looks like Steam accounts/data have been breached (well about 2/3rds of them). The data is being sold on the darkweb. It is recommended to change your password and enable two factor authentication if you have not done so already.

Steam reportedly hit by massive data breach, you're urged to change 1 setting asap

The Valve storefront has been hit with a data breach that could affect millions of users

www.gamingbible.com

89 million Steam accounts reportedly leaked. Change your password now.

And keep an eye out for suspicious activity or phishing scams.

mashable.com

 

[JTsyo]

What I'm been following says it wasn't Steam but a 3rd party SMS 2FA provider. One that Steam doesn't use.

You Don't Need to Panic Over the Latest Steam 'Leak'

An alleged leak of more than 89 million Steam user records may not actually be cause for panic, though it doesn't hurt to ensure you have additional authentication set up on your account.

lifehacker.com

Valve's message: https://store.steampowered.com/news/app/593110/view/533224478739530145?l=english

 

[Fallen Kell]

Yeah, looks like we are all good and no password info was compromised:

Steam Says There's No Need to Change Your Password After Data Breach. But Set Up This Safety Feature Anyway

Even if there wasn't a breach of Steam's systems, 89 million phone numbers were leaked.

www.cnet.com

 

[Fanatical Meat]

I don’t get what would happen with a hijacked steam account. Sure the could buy or gift games but it’s certainly going to be a real temporary gain. Stuff’s all tracked in steam and there is no physical merchandise.

 

[Fallen Kell]

Sure, but they could buy one or more steam decks and have them shipped and resell. You may also get your account banned, and then have to deal with proving it was hacked to get un-banned and lose access to one or more of your favorite online games while the ban is in place.

The first one makes the assumption that someone stored their credit card info with the account, but a heck of a lot of people do that, so it is just a couple clicks away from making a purchase the credit card for a steam deck that they ship to a different location as a "gift". I am sure there are other ways to make money, like purchasing or selling digital goods like trading cards etc., on the steam market at inflated/insane prices from the "seller" that is a "legit" account that the thief then can use the credit to buy games that they want.

 

[Fanatical Meat]

Sure, but they could buy one or more steam decks and have them shipped and resell. You may also get your account banned, and then have to deal with proving it was hacked to get un-banned and lose access to one or more of your favorite online games while the ban is in place.

The first one makes the assumption that someone stored their credit card info with the account, but a heck of a lot of people do that, so it is just a couple clicks away from making a purchase the credit card for a steam deck that they ship to a different location as a "gift". I am sure there are other ways to make money, like purchasing or selling digital goods like trading cards etc., on the steam market at inflated/insane prices from the "seller" that is a "legit" account that the thief then can use the credit to buy games that they want.

Steam deck I get that.
I don’t get having the account banned.
I have the compromised credit card, they know my IP address, they know my DOB, I cannot imagine proving an account was compromised being that difficult.
Also steam decks aren’t serialized? However I do understand why a vendor wouldn’t pick a fight over someone buying a stolen steam deck, the deck exists to sell steam games.

 

[Fallen Kell]

Steam deck I get that.
I don’t get having the account banned.
I have the compromised credit card, they know my IP address, they know my DOB, I cannot imagine proving an account was compromised being that difficult.
Also steam decks aren’t serialized? However I do understand why a vendor wouldn’t pick a fight over someone buying a stolen steam deck, the deck exists to sell steam games.

Proving the account was compromised isn't that hard, and I agree with that. Getting all the various anti-cheat/anti-bad-behavior software used on all the different multiplayer games to re-enable you is the hard part. Not everything just uses Steam's VAC (Valve Anti-Cheat). The individual games may all use their own thing and you would need to deal with the individual game companies, and that might take weeks of back a forth, with you needing to contact the game company which will just believe it is a lie to have the ban removed, ultimately requiring Steam to contact that company directory as they won't believe a forwarded email chain from your contacts with Steam is anything more than an AI generated spoof... It can and will take weeks, and you might need to do that with multiple games if the people who gained access to your compromised Steam account played all the current most popular games and got you banned in them because they don't care how they behaved and if they tried to cheat or not....

 

[Fanatical Meat]

Proving the account was compromised isn't that hard, and I agree with that. Getting all the various anti-cheat/anti-bad-behavior software used on all the different multiplayer games to re-enable you is the hard part. Not everything just uses Steam's VAC (Valve Anti-Cheat). The individual games may all use their own thing and you would need to deal with the individual game companies, and that might take weeks of back a forth, with you needing to contact the game company which will just believe it is a lie to have the ban removed, ultimately requiring Steam to contact that company directory as they won't believe a forwarded email chain from your contacts with Steam is anything more than an AI generated spoof... It can and will take weeks, and you might need to do that with multiple games if the people who gained access to your compromised Steam account played all the current most popular games and got you banned in them because they don't care how they behaved and if they tried to cheat or not....

Ah I see