Looks like Valve’s Christmas present is a massive data screw-up, with popular gaming service Steam gushing users’ personal details and more. Gamers hoping to spend some holiday cash today found they were instead being served up with other Steam users’ accounts, complete with their registered addresses, access to any saved funds on their account, and the apparent ability to make new purchases against their stored payment methods.
There’s also access to users’ purchase history and their removed games, along with their email address and at least part of their phone number.
Some users are reporting seeing random language changes when they log in.
If you have a Steam account, right now exactly what you should do is unclear. For many who have linked their Paypal account, the first option seemed to be logging into Paypal and unlink the two, to hopefully avoid any false charges.
Update: according to Steam Database, an unofficial Valve-focused group, it may be safer to leave things intact and basically touch nothing:
Do NOT attempt to unlink PayPal, remove your credit card details or anything else. Doing so will put you at risk instead.
— Steam Database (@SteamDB) December 25, 2015
Those with a saved credit credit card directly on Steam’s Store itself may be less lucky, since actually getting into your account to remove those details is proving a challenge.
Valve is yet to comment on the issue, and right now there’s no saying whether this is some sort of self-inflicted glitch or if Steam has been the victim of something malicious.
Update: Steam is back online, and according to a statement by Valve to Gamespot no illicit use of that user-data has been observed:
“Steam is back up and running without any known issues. As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users” Valve