On Christmas Day, hackers took down popular online video gaming site Steam. As Steam fixed the problem, some sensitive information about users was accidentally exposed.
Steam tells Business Insider that it has the situation under control and no one needs to “take any action” if they suspect their account was revealed that day.
If they still think their account was hacked and needs attention, the spokesperson told us users should contact support at help.steampowered.com.
But it seems like Steam has some other problems with account security that need to be addressed.
One Steam user came forward with a story about how someone from Russia put money in his account, changed the country of origin to Russia (i.e. the country where Steam thinks the user lives), and now he can’t change it back. He says he’s been emailing Steam for months and they have yet to respond.
The user is from Milwaukee. When he logged into his account, “I noticed that Russian rubles were deposited into my account and my location was changed to the Russian Federation. Nothing I try undoes that. So I’ve attempted to get a reply from Steam as to how I delete my account. Not a peep from them. Nothing. Obviously I’m very very uneasy knowing that my account is under a Russian hacker’s control,” he told us.
He shared a screen capture of his account. Sure enough it shows his Steam Wallet holding rubles and Steam thinks the account belongs to someone in Russia:
We reached out to Steam to ask what’s up with this, and we were told that the account was not hacked at all:
“The specific account in question is actually not hijacked, but had Russian wallet credit added from a Kiosk in Russia due to a Russian user mistyping the wrong account name. This user should also contact support to have the credit removed and their billing country restored, but their account security is not compromised.”
We asked, wouldn’t someone need a password in order to add money to an account?
The spokesperson told us, “No password is required.”
Other people have had this same situation happen, according to a thread on Reddit and in at least one case, a Steam representative did reply.
That person was told, “There is a payment method in Russia that allows users to input cash into a kiosk and send the funds to their Steam account. It appears as though a Russian customer has entered the wrong Steam account name, yours, by mistake. Your account was not compromised, they have just sent funds to your account accidentally.”
Steam insists such happenings are no big deal, but there is something unsettling about it, the Milwaukee user says, especially because he can’t simply log in, with his password, and fix the problem. “I tried changing my country yesterday and could not. It’s trapped in ‘Russian Federation’.”
And he’s still hoping that his emails to Steam to fix it or delete his account will get noticed, he says.