Chicago (IL) - A hacker claims to have gotten hold of a mountain of sensitive data from software company Valve, including credit card information from users who have purchased content from its digital distribution system Steam.

An online user by the pseudonym MaddoxX has posted a message on an anti-Valve site with pictures of what he claims are internal Valve files, including the company's balance sheet and customer transaction data.

When concerned users began talking about the reported hack on Valve's official message boards, the conversations were deleted.  Valve has not yet made an official statement about the events, which began to unfold yesterday afternoon.

MaddoxX's online profile says he is a 22-year-old man from Russia.  In his original posting, MaddoxX writes, "Woohoo VALVe you can see those creditcards...on the internet anytime soon.  [I] just need to finish the excel files."  Moreover,  he seems to be holding the sensitive data hostage and asking for some kind of ransom.  Calling out Valve, he says, "I prefer you come with something good unless you want me to expose ALL of the customers [and] their information."  

If the hack is serious, Valve is legally obligated to inform its customers in some states.

Valve has not yet responded to our inquiries.

Time to change your credit card numbers......

Apr 19, 2007 11:12     

Time to change your credit card numbers...
No Name report abuse vote down vote up Votes: +0

Valve's security breached again?

Apr 19, 2007 11:25     

I hope this is just a hoax of some sort, because after the Source code theft prior to HL2 release and now this, i think this will compromise their online distribution model very quickly....
Mcmonopoly report abuse vote down vote up Votes: +0

yikes....

Apr 19, 2007 11:30     

This could mean ID theft on a global scale if this stuff gets released onto the internet... Was just thinking "thank god I never bought anything offa steam" when I realized I bought Ep 1 there... >_< I hope this doesn't cause any serious problems, or it's gonna seriously damage the credibility of digital distribution services
al report abuse vote down vote up Votes: +0

Credit Card online has *always* been a fiasco in terms of security, the way it is

Apr 19, 2007 14:07     

Since its inception, being able to use a credit card online just by knowing its holder name, expiry date, and its number has been a ridiculous notion. All this information can be acquired within seconds when someone looks at your credit card using variety of means, let alone hacking databases. Why and how they did not come up with a pin number just like ATM's is unknown to me. This number would only be passed once, never to be remembered, and the payment would be done through the banks own servers (like paypal doing the transaction on its own servers, you don't give your paypal password to the online shop). As for recurring payments, well they don't make sense altogether!

Emrah Baskaya report abuse vote down vote up Votes: +0

another asshole..

Apr 19, 2007 20:47     

don't worry people, I know the ***** who goes by maddoxx, he's an *** teenager and lives in paraguay.. and yes.. he's lying and laughing the hell out all the atention that the media are giving
Dunlop report abuse vote down vote up Votes: -2

liability?

Apr 19, 2007 21:20     

Is valve liable for any damages caused to my credit account if purchases are made using the list of numbers this guy obtained?
Tony report abuse vote down vote up Votes: +0

PIN

Apr 20, 2007 07:32     

@yikes I have had a pin for my visa online use for ages. Its called "verified by visa"
boots report abuse vote down vote up Votes: +0

who would be anti-valve?

Apr 20, 2007 08:40     

they're easily one of the best game developers out there right now, releasing well done and very complete and polished games. I can't imagine why anyone would hate them.
Erich report abuse vote down vote up Votes: +0

It should be noted that...

Apr 20, 2007 10:08     

He did not claim to steal information from the Steam software application, instead he claims to have hacked into a database for a Cyber-Cafe partnership program that Valve runs on the side. If you haven't been to one of these Valve Sponsored Cafe's you should be okay, as Valve has stated repeatedly that credit card information is not retained by the Steam software service.
Johigglesvash report abuse vote down vote up Votes: +0

What The Guy Really Hacked....

Apr 20, 2007 10:52     

found this at dailytech.com Doug Lombardi, director of marketing at Valve, "There has been no security breach of Steam. The alleged hacker gained access to a third-party site that Valve uses to manage the commercial partners in its Cyber Café program. This Cyber Café billing system is not connected to Steam. We are working with law enforcement agencies on this matter, and encourage anyone with more information to e-mail us at This e-mail address is being protected from spam bots, you need JavaScript enabled to view it "'; document.write( '' ); document.write( addy_text52994 ); document.write( '<\/a>' ); //-->\n This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Dark Ninja report abuse vote down vote up Votes: +0

Time to stop releasing FUD

Apr 20, 2007 14:40     

This has been shown to have been a false alarm to MOST Steam customers. It's only for the Cafe system which is ran by a third-party and not Valve. Steam customers are safe.
I.S. report abuse vote down vote up Votes: +0

i am not so sure it's a false alarm

Apr 28, 2007 03:41     

I know this kind of guys. I have seen a lot of things like this but this one is over the line. No hacker stupid, drunk or smoked would ask for a ransom. He would do his job silently... empty those CC because now he has them from the database. Why everyone is saying "AAAA Valve?How was it possible?" ... C'mon guys... what does it have Valve and NASA doesn't? NASA was hacked by romanian kids ... turkish... indian.. and russian. Valve is another conquer. Take care what and from where you're buying on the internet. Make sure the site requires CVV or CVN because .... if it doesn't then your CC is toasted if it gets in a kid hands.

Enz0 report abuse vote down vote up Votes: +0