Steam Caching Error leads to Account Disclosure

 

Steam, a gaming platform used by many PC gamers, suffered problems on Christmas Day when it began to display cached pages of other logged in users to people visiting their site. Users reported that when visiting Steam, they were being shown as logged in as someone else, the store pages were in different languages, and items began to appear in their cart and wish-list. 

Among these mistakenly shown pages was also the account details page which allowed visitors to see other Steam user's details such as their login username, email address, wallet balance, last 4 cell number digits (if linked), steam guard status, purchases, and saved payment method which exposed mailing/home address and the last 2 digits of their credit card number or their entire PayPal address (if they decided to save their payment method).

The Steam store remained online for an hour after this issue was reported before finally being pulled offline to fix these issues. 8 hour laters, Valve told GameSpot that a configuration change made on their servers earlier that day caused a caching issue and that no unauthorized transactions were able to be performed by visitors seeing these cached pages.