The popular online video game distribution system Steam was hacked and a database containing user names, passwords, user credit card information was compromised.

The breach was confirmed in a public post by Gabe Newell, the CEO of Valve, the company that developed and manages Steam. He says there is no evidence that the encrypted database of credit card info was cracked. Newell told users that they weren’t going to force a manual reset of user passwords. “However,” he said, “it wouldn’t be a bad idea to change that as well” as the password to their Steam message board accounts.

The unauthorized access was discovered after the Steam message board forums were defaced by intruders on Sunday, November 6th. Valve disabled the forums and they’re currently still offline.

“I am truly sorry this happened, and I apologize for the inconvenience,” wrote Newell. “We are still investigating.”

If you have a Steam account, change your user password. If you have a Steam forum commenter account, change your password. If you have used your credit card to buy anything from Steam, you should watch your credit card bill and watch out for any unauthorized purchases or activity.

Over 1,400 video games are distributed through Steam. The service has has 35 million users.

Here’s the entirety of Newell’s note to users:

Dear Steam Users and Steam Forum Users:

Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.

We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.

We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.

While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.

We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn’t be a bad idea to change that as well, especially if it is the same as your Steam forum account password.

We will reopen the forums as soon as we can.

I am truly sorry this happened, and I apologize for the inconvenience.

Gabe.

Dear Steam Users and Steam Forum Users [forums.steampowered.com] (Thanks to Anti!)

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.