Steam Login Details sold by Steam/Valve

[Spooky]

Can someone explain why my exact login name has cropped up on a blatant marketing spam email from some company I've never traded with? Namely a company called Suunto and/or ISPO? Anyone else had this?

The details could only have come from Steam since the spam starts 'Dear #Steamuserloginname#....'

I realise that Steam have a clause somewhere to allow the resale of all of your private data to random internet companies. But to broadcast your login details with it? Come on!

Or was this from some previous hack of Steam's servers?

[Count_Dandyman]

Honestly its much more likely that its from you handing out your details to another person or 3rd party site if Steam was involved in something like this they wouldn't be wasting it on such a small scale to target you alone.

[Spooky]

Nope never used my weird login name anywhere else. It was chosen by steam a long time ago when the account was generated.

[Spooky]

I might actually contact the company to see how they acquired it though that lends itself to more abuse, but I'll be interested to see where else my login name shows up next. Should show somesort of trail.

[Spooky]

Ah well I might have found the answer to my own question:

https://www.theguardian.com/technology/2014/may/30/steam-valve-password-hack-stolen-botnet-malware

Still at least I know my own machines were never infected by this stuff, being regularly cleaned and defended by using antimalware systems. However I never considered the vulnerability of the marketplace system for buying and selling cards and stuff.

Guess it was inevitable that the data would be farmed out eventually.

[Start_Running]

Translation. You click on sketchy liknks you geet sketchy stuff on your PC.

[Jaunitta 🌸]

Originally posted by Spooky:

Nope never used my weird login name anywhere else. It was chosen by steam a long time ago when the account was generated.

Steam will never choose your login name??
You are so mistaken about Steam privacy and security.
Do you have the Steam Guard?
You do know and understand how that works?
It says if you choose to ignore the security protocols of Steam you will be hacked or your account stolen.
Also Valve owns Steam.
What is the Steam Guard Mobile Authenticator?
https://support.steampowered.com/kb_article.php?ref=8625-wrah-9030

[Start_Running]

Originally posted by Jaunitta 🌸:

Originally posted by Spooky:

Nope never used my weird login name anywhere else. It was chosen by steam a long time ago when the account was generated.

Steam will never choose your login name??
You are so mistaken about Steam privacy and security.
Do you have the Steam Guard?
You do know and understand how that works?
It says if you choose to ignore the security protocols of Steam you will be hacked or your account stolen.
Also Valve owns Steam.
What is the Steam Guard Mobile Authenticator?
https://support.steampowered.com/kb_article.php?ref=8625-wrah-9030

Okay to FYI. There was a point early in Steam where you did not choose your login in name. Thather it was simply the email address you chose to use as your contact point.

[Tito Shivan]

Originally posted by Start_Running:

Okay to FYI. There was a point early in Steam where you did not choose your login in name. Thather it was simply the email address you chose to use as your contact point.

And if you've ever used that same email anywhere else:
https://haveibeenpwned.com/

[Spooky]

What has using Steam Guard got anything to do with this? Doh. Never mind. Totally unrelated.
Yes in the 'early days' Steam suggested your login. No it was not your email because that would be so blatantly hackable but hey. Simply, when registering for the first time you entered your chosen login - inevitably unavailable because it was already taken by someone else - and Steam took your choice and gave you some options based on your original entry. As many websites do. Perhaps you haven't been around long enough to notice this.

Hence your login name was effectively chosen by Steam.

Valve owns Steam. Right. So what. Microsoft own Skype. And how does this affect anything.

As Ripley said 'Perhaps IQ's have dropped since I've been away!" 'So mistaken ... LOL'

So yeah email and login are stored in a DB on a Steam server somewhere. But I've never received a spam email which used my login name. So that would imply a definitive connection to Steam.

I often use random emails from my domains for registration eg on slightly suspect sites for downloading freebies or registrations to track spam sources. That way you know who is selling the information on. Then I can easily kill off a spam source by simply removing the email address from the email server at which point it will be bounced back indefinitely.

Clearly at some point the information was extracted and dumped on the web. Along with that from LinkedIn, or BA or any other large corps in the last 15 years. I just hadn't notice that they had been hacked previously -an oversight by me - on the Wiki list of major hacked sites. Rarely are the logins directly connected to personal data i.e. side by side on a DB system - for security. In the same way you don't keep CC data in a giant spreadsheet with names addresses and email addresses.

https://en.wikipedia.org/wiki/List_of_data_breaches

Maybe it's not considered that major. 35,000,000 possible entries lost in 2011. There's little financial info stored by Steam's systems so not that critical maybe?

If possible, I'll change the login ID linked to the account, rather than just the avatar name which chanes nothing useful. Then I can at least see if it happens again.

[Spooky]

Well clearly changing Steam ID is impossible. Or transferring it. How handy!! Guess that's considered a financial risk or account theft risk. NM. Just one of those things. Time to switch the Steam account to a temporary email address to see if it happens again. And change the password again (monthly job) just to be sure!!!