PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOn December 25, 2015, Steam suffered a denial-of-service attack during its Christmas sale. An emergency caching change intended to keep the Steam Store online then caused some personalized pages to be served to the wrong users. Valve said requests associated with about 34,000 users may have been viewed by other Steam users.
The incident exposed limited personal information such as billing addresses, purchase histories, email addresses, and partial phone or card details. Valve said passwords, full credit-card numbers, and information sufficient to log in or complete a transaction were not included. The event was therefore best understood as an accidental privacy exposure caused by a caching configuration error—not evidence of a conventional password or database theft.
As an Amazon Associate I earn from qualifying purchases.
What happened to Steam on Christmas Day 2015?
The Steam Store was targeted by a denial-of-service attack while Valve’s Christmas sale was underway. Valve described the attack as a DoS attack; contemporary reports commonly called it a DDoS attack. Traffic reportedly rose to approximately 2,000% above the average level for the Steam Sale, making it difficult for Steam to reliably serve Store pages.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTo reduce the load and continue serving legitimate visitors, Steam and its web-caching partner introduced caching rules. During a later wave of the attack, a configuration error caused the caching system to handle authenticated, user-specific traffic incorrectly. Instead of keeping a personalized response associated with the person who requested it, the system could return that response to another Steam user.
#1 Best Overall
- International (UK) Version
- 7.4” diagonal, HDR OLED, 1280 x 800 x RGB, up to 90Hz Refresh rate, High performance touch, <0.1 ms Response time, 1,000 nits peak brightness (HDR), 600 nits (SDR)
- SteamOS 3.0 (Arch-based)
- 512GB NVMe SSD, 16GB LPDDR5 on-board RAM (5500 MT/s quad 32-bit channels), microSD UHS-I supports SD, SDXC and SDHC
- 6 nm AMD APU, CPU: Zen 2 4c/8t, 2.4-3.5GHz (up to 448 GFlops FP32
Valve explained the incident in its December 30, 2015 statement, “Update on Christmas Issues.”
The exposure window
According to Valve, the relevant period was:
- Date: December 25, 2015
- Time: 11:50 a.m. to 1:20 p.m. Pacific Standard Time
- Potentially affected requests: approximately 34,000 users
The 34,000 figure needs careful interpretation. Valve said Store-page requests for about 34,000 users may have been returned to and viewed by other users. It did not say that 34,000 unique accounts had definitely been hacked, that every user’s information was seen, or that attackers had extracted a database.
A user also was not automatically affected merely because they had a Steam account. Valve said users who did not browse a qualifying Store page containing their personal information during the window could not have had that information displayed through this incident. The exact information at risk depended on which page was requested and cached.
Recommended Free Tools
What information may have been visible?
Valve said that some incorrectly served pages could contain one or more of the following:
- Billing address
- Purchase history
- Email address
- The last four digits of a Steam Guard phone number
- The last two digits of a credit-card number
The contents varied by page. This was not a uniform profile of every affected user, and the available public statement does not establish that all listed fields appeared together.
What was not exposed?
Valve said the cached responses did not contain:
- Full credit-card numbers
- Steam passwords
- Enough information to log in to an account
- Enough information to complete a transaction as another user
Partial payment details and personal information can still be sensitive, particularly when displayed to an unintended person. However, the exclusions are important: this was not reported as a theft of complete payment credentials or a credential dump.
How did a DoS attack cause a privacy incident?
A denial-of-service attack primarily threatens availability: users cannot reliably reach a service because it is overwhelmed or otherwise disrupted. A shared cache is normally used to store reusable web responses closer to visitors, reducing the amount of work required from the origin servers.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →That model is appropriate for content that is the same for everyone, such as a public game description. It is dangerous for pages containing authenticated, user-specific information. A personalized page should either bypass a shared cache or be stored and retrieved under rules that strictly isolate one user’s response from another’s.
In this case, the emergency configuration treated authenticated traffic incorrectly. A page generated for one user could become a cached response that was returned to another user. Some people reportedly saw pages in the wrong language or encountered another user’s Store or account-related information.
The causal chain was therefore:
- The attack disrupted Steam Store availability.
- Emergency caching rules were introduced to reduce pressure on Steam’s infrastructure.
- A later configuration incorrectly cached authenticated traffic.
- Some personalized responses were served to the wrong users.
- Steam shut down the Store, corrected the configuration, and purged cached data before restoring service.
The attack caused the availability problem; the caching error caused the cross-user disclosure. Treating them as a single “hack” obscures the technical failure that actually exposed the information.
Rank #3
- 【Upgraded】We sells product with professionally upgraded to 2TB SSD. Original Seal is opened for upgrade ONLY.
- 【Stunning 7.4" HDR OLED & 90Hz Motion】 Experience striking contrast and brilliant clarity with the all-new 7.4-inch HDR OLED display. Designed from the ground up for gaming, it features a 90Hz refresh rate for smooth motion and pure blacks. This handheld is capable of delivering an immersive visual experience, ensuring your Steam library looks better than ever with vibrant colors and amazing motion rendition.
- 【30-50% More Battery & Efficient Performance】 Play your favorites longer with up to 50% more battery life. By fitting a larger battery and a power-efficient OLED panel, this device provides extended gameplay sessions. It’s the perfect travel companion for long flights or commutes. The updated AMD APU ensures high-speed performance for AAA titles while maintaining incredible energy efficiency.
- 【3X Faster Downloads with Wi-Fi 6E】 Never wait for a game again. Equipped with Wi-Fi 6E, this Steam Deck OLED offers increased bandwidth and lower latency, delivering downloads up to 3 times faster than previous models. This ensures stable online play and rapid updates, making it the most reliable wireless gaming handheld for modern high-speed home networks.
- 【Responsive Touch & Enhanced Connectivity】 Enjoy a vastly improved touchscreen with higher fidelity and faster haptics. We’ve added a dedicated Bluetooth antenna to improve connections for multiple controllers. Whether using the built-in trackpads or the included external controller, this allows for precision play in everything from FPS to complex strategy games.
Was Steam hacked?
“Hacked” is an imprecise description of this incident. Valve’s account did not describe an attacker breaking through Steam’s password system, stealing a customer database, or obtaining users’ complete payment information.
The more accurate description is: a privacy breach caused by a caching configuration error during Steam’s response to a denial-of-service attack. Other users could receive pages generated for different authenticated users because the caching layer failed to keep personalized responses separate.
That distinction does not make the exposure harmless. Unauthorized people may have viewed personal information. It does mean the event was materially different from an attack in which criminals obtain passwords, database records, or reusable card numbers.
What did Valve do to contain the problem?
After identifying the issue, Steam shut down the Store and reviewed the caching configurations. Valve said it deployed a corrected configuration across the partner servers and purged cached data from edge servers before bringing the Store back online.
Valve also apologized and said it was reviewing the process used for handling similar attacks and emergency changes. The public statement did not provide a complete technical postmortem with the exact cache-control headers, routing rules, deployment architecture, or the name of the caching partner.
Rank #4
- 512 GB NVMe SSD: Fast storage for quicker game load times and space for larger game libraries.
- OLED Display: 1200x800 resolution with deep contrasts and vibrant colors for a captivating visual experience.
- Custom AMD APU: Power-efficient Zen 2 CPU and RDNA 2 GPU for desktop-level gaming performance.
- Expandable Storage: Add more space with a microSD card slot, ensuring you can bring even more games with you.
- Versatile Controls: With built-in thumbsticks, trackpads, and touchscreen controls, you have full control over your gaming experience.
Did affected users need to change their passwords or cards?
Valve said that no additional action was required for this incident. Its explanation was that the problem involved viewing cached page information and did not provide the ability to log in to another account, perform unauthorized account actions, or complete a transaction as another user.
That guidance applied to the Christmas 2015 caching incident specifically. General account-security practices remain sensible: use a unique password, enable available Steam security protections, and contact Steam Support through its official recovery process if there is evidence of a separate account compromise.
The available statement does not support presenting password resets, card replacement, or credit monitoring as mandatory remedies for this event.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the wording around “34,000 users” matters
Several distinctions prevent the headline from overstating what is known:
- Potential exposure is not confirmed viewing. Valve described requests that may have been returned and viewed by other users, not a final count of people whose information was definitely seen.
- Affected requests are not necessarily unique victims. The figure referred to requests for users and should not automatically be treated as 34,000 confirmed, uniquely compromised accounts.
- Exposure is not exploitation. A page could be displayed to another user without giving that person the ability to access the account or use its payment method.
- Not every field appeared on every page. The potential content depended on the Store or account-related page involved.
The public record also does not establish a final number of confirmed viewers, a complete list of every page type that could have been mis-served, or a public compensation program.
Best Value
- Valve is entering the gaming console marketplace with the new Steam Deck, a console geared towards PC gamers. The Steam Deck can be docked to a monitor, and used as a PC, or docked to a TV.
- Players can play a huge variety of games at any time with the comfort of a console and the freedom of a PC. Not anti-glare screen.
- Like the name suggests, the Steam Deck will include upgraded 1TB storage, and will include a carrying case. A micro SD slot will also enable expanded storage.
- Valve partnered with AMD to create a specialized APU optimized for handheld gaming, and Valve says the chip will deliver performance to run AAA gaming titles.
- The Steam Deck is outfitted with a 7-inch touchscreen, and two trackpads under the control sticks that allow gamers to operate games never designed outside of mouse and keyboard capabilities.
The security lesson
The incident demonstrates how a change made to protect availability can create a confidentiality risk. Under attack conditions, an organization may need to change traffic-management or caching behavior quickly. But personalized authenticated content must remain excluded from shared caches, even when the normal service is under extreme pressure.
Emergency infrastructure changes should therefore be staged and validated with tests that cover:
- Authenticated and unauthenticated requests
- Different user accounts requesting the same URL
- Language, region, and device variations
- Cache hits and misses at every edge location
- Responses containing account, purchase, billing, or contact information
A successful availability test—“does the page load?”—is not enough. The system must also answer the confidentiality question: does each user receive only the response intended for that user?
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bottom line on the Steam Christmas incident
Steam was hit by a DoS attack on December 25, 2015, and an emergency caching misconfiguration caused some users’ personalized Store pages to be shown to other users. Valve said requests associated with about 34,000 users may have been exposed during a 90-minute window.
Potentially visible data included billing addresses, purchase histories, email addresses, and partial phone or card details. Valve said passwords, full card numbers, and information sufficient for account login or transactions were not included. It was a serious temporary privacy failure, but the evidence does not support describing it as a conventional password theft or mass account takeover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
