Valve tells users about Christmas fiasco, explains why Steam was down

Valve has put out a  blogpost  explaining why its gaming platform Steam faced an outage during Christmas.

On December 25, between 11.50AM PST and 1.20PM PST, a configuration error compelled some users to see pages generated for other users. Some of these pages included the billing address, last four digits of the Steam Guard phone number, purchase history, last two digits of credit card number and email addresses. However, the details didn’t give out complete account numbers, user passwords and data enough to log into other accounts, claims Valve.

Why it happened? Valve has confirmed that early morning on the Christmas day, the gaming platform was a target of a DoS attack that ‘prevented the serving of store pages to users’. Valve says such attacks on Steam are regular and the company along with some partners handles them so that they do not impact users. However, during Christmas the traffic to the store increased 2000 percent over the average traffic during the Steam sale.

“In response to this specific attack, caching rules managed by a Steam web caching partner were deployed in order to both minimize the impact on Steam Store servers and continue to route legitimate user traffic. During the second wave of this attack, a second caching configuration was deployed that incorrectly cached web traffic for authenticated users. This configuration error resulted in some users seeing Steam Store responses which were generated for other users. Incorrect Store responses varied from users seeing the front page of the Store displayed in the wrong language, to seeing the account page of another user,” Valve explains in the blogpost.

On identifying the error, the Steam Store was shut down. Valve deployed a new caching configuration. The store was down until it was confirmed that all caching configurations were reviewed and the latest configurations were deployed to all.

Valve assures that it will improve the process to tackle such issues and has apologised for the error as well as interruption to the service.