An unusual system glitch occurred last week that allowed Steam users to view personal account information of random strangers last week, which included email address and purchase history. Steam owner Valve Corp was forced to temporarily suspend service while it worked to resolve the issue, but even after service was restored, the company said nothing to users.

Instead, it issued only a brief statement, saying only that it had resolved “a caching issue” that did not have any serious security implications. Today, nearly a week since the incident occurred, Valve corp has broken its silence on glitch and issued an apology to Steam users.

According to Valve, the problem was the caused when its web cache overcompensated in response to a denial of service (DoS) attack that occurred on Christmas. The attack caused a 2000 percent increase in traffic and disrupted the Steam Store’s services.

“In response to this specific attack, caching rules managed by a Steam web caching partner were deployed in order to both minimize the impact on Steam Store servers and continue to route legitimate user traffic,” Valve explained. “During the second wave of this attack, a second caching configuration was deployed that incorrectly cached web traffic for authenticated users. This configuration error resulted in some users seeing Steam Store responses which were generated for other users. Incorrect Store responses varied from users seeing the front page of the Store displayed in the wrong language, to seeing the account page of another user.”

The account information some users had been able to view as a result of the caching issue included “a Steam user’s billing address, the last four digits of their Steam Guard phone number, their purchase history, the last two digits of their credit card number, and/or their email address.”

“We will continue to work with our web caching partner to identify affected users and to improve the process used to set caching rules going forward,” Valve said. “We apologize to everyone whose personal information was exposed by this error, and for interruption of Steam Store service.”

Image courtesy of Valve Corp