

Screenshots posted by MaddoxX reveal the extent of the breach


  • Screenshots of internal Valve web pages
  • A portion of Valve's Cafe directory
  • Error logs
  • Credit card information of customers
  • Financial information on Valve



MaddoxX does make one thing quite clear in his electronic manifesto:


Comments     Threshold


RE: Valve Still have their thumbs up their butts?
By sciss0rz on 4/20/2007 2:05:17 AM , Rating: 2
There won't be a warning to the Steam users since there was no breach. I would assume Cafe owners have been alerted already. Unless Cafe subscribers haven't been alerted, then Valve has screwed up.

By emboss on 4/20/2007 2:22:05 PM , Rating: 3
Cafe owners were not notified (and still have not been directly notified by Valve - the only notification has been a short announcement on the Steam forums). Some have contacted Valve to ask why not, and have been told that they were not notified because Valve were not legally required to do so. This could be interesting given the California bill mentioned above. As is usual with Valve, it's not the initial incident that gets people annoyed, it's how Valve handles it - covering it up, lying, ignoring support requests, etc etc.

What should have happened is a week ago (I'm being kind here - they potentially knew of it as early as late March, but there's only concrete proof of their knowledge going back a week or two) when Valve were contacted about the leak they should have notified the cafe owners (assuming of course that Valve is in fact telling the truth for once and it's only the cafe customers that have been affected). If it became public like it is now, they should have quickly posted an announcement on the Steam website and/or forums saying it was limited to the cafes to avoid panic.

Instead, they don't tell the cafe owners who in the end find out through Anadtech, Digg, etc. The rumor becomes that all Steam purchases are potentially affected, so people post on the Steam forums and lodge support tickets about it. The Steam threads are deleted and the posters banned, and the support tickets go unanswered. It takes over 36 hours until an announcement appears on the Steam forums, and even then it doesn't directly answer many of the questions. Threads pertaining to the issue continue to be deleted and posters continue to be banned. In the meantime, people have (quite validly) prepared for the worst and cancelled cards, notified banks, etc etc.

This is becoming a typical Valve pattern whenever something goes wrong:
1) Say nothing and keep any trace of the issue off the Steam forums.
2) If the issue becomes widely published, post a short statement downplaying the issue or claiming that it doesn't exist.
3) Once overwhelming evidence shows that the statement in step 2 was a complete lie, mumble something in a quick press statement and then never discuss the issue again (and continue to censor the forums as well, of course).

In addition to hiring some people with a clue about security, Valve really need to hire a few people with PR training to stop screwing up like this.

