The IT Nerd

Steam, Valve’s video game distribution platform, has started warning its customers by email. According to Valve, between July 29 and August 1, attackers hit CEVA Logistics, the company that handles shipping of Steam hardware to customers across Europe.
 
To do that job, CEVA receives delivery details from Steam — and the attackers likely walked away with customers’ names, street addresses, phone numbers, email addresses, and details of what they ordered and how much it cost.
 
Karolis Arbaciauskas, head of product at the cybersecurity company NordPass and its parent organization Nord Security, comments:
 
“Customers who waited months for their Steam hardware just got an unwelcome bonus: a data breach at the shipping company.
 
The good news is that passwords, payment details, and Steam Guard codes weren’t touched. The bad news? Names, addresses, phone numbers, emails, and order details are exactly the ammunition cybercriminals need for convincing phishing campaigns. When a scammer can quote your real address and order back to you, a fake ‘confirm your delivery’ email stops looking fake.
 
Affected users should expect a wave of fraudulent emails, texts, and calls impersonating Steam, Valve, or courier companies. Users should especially watch for classic customs fee scams, redelivery scams, and fake password resets.
 
The latter is one of the most dangerous, because clicking the link and ‘resetting’ your password hands the keys to your entire Steam account to hackers, game library and all. A recent study shows that stolen Steam accounts sell for around $80 on dark web marketplaces.
 
So stay vigilant: never click links in unexpected messages, and remember that Steam Support will never ask for your password or Steam Guard code — and neither will a courier. If a message creates urgency, that’s your cue to slow down.”

For more details, check this link: Valve emailed about a cyberattack against their shipping partner CEVA Logistics in Europe | GamingOnLinux

In the meantime, stay vigilant.

Valve’s Steam service was down for about 2.5 hours today. That means you weren’t playing any games, or buying anything using the service. The timing sucked for Steam as this happened at the start of their Winter Sale. Plus they’ve also started voting on the Steam Awards.

Predictably, people took to Twitter to express their views:

Please steam… I will never take you for granted again, just come back please #playersrights

— Jesper Wecksell (@JW1) December 23, 2016

Steam right now pic.twitter.com/UfcbZfSQWi

— Hai (@WhatTheHai) December 23, 2016

Waiting for Steam to come back online like pic.twitter.com/QHTe0BM01E

— Dignitas (@dignitas) December 23, 2016

But at 1:40 PM EST, it came back up. Thus you can go back to pwning your competition over the holidays. Though there are rumors that Steam was attacked as per these Tweets from a hacker who goes by the name Cripthepoodle, who claimed to be once part of the PoodleCorp hacker group as well as tweet from the Phantom Squad hacker group. Both have apparently threatened wide spread DDoS attacks over the holidays aimed at Steam, Xbox Network and PlayStation Network:

Steam offline #merrychristmas

— crip (@cripthepoodle) December 23, 2016

I Stopped attacking steam, it should take awhile to restore since maintenance needs to clean stuff up.

— crip (@cripthepoodle) December 23, 2016

In case you’re wondering why the last Tweet is a screen grab, it’s because Phantom Squad’s Twitter feed has been suspended by Twitter.

Now this sort of thing isn’t new. Lizard Squad did it in 2014 and  brought Xbox Network and PlayStation Network down for a week. Last year, Steam was taken down for three days or so.

I’ll be monitoring this to see if additional attacks come in the next few days.