I need to report a hack or hack attempt - Steam support has NO OPTION for this

[76561198147871868]

Basically, I had a prior account to which I unexplainably lost access to, a few years ago.
Back then, password retrieval access did not work, which forced me to create this account, which has been active since.
Today, I received an automated email from Steam, showing that someone was trying to obtain access to my OLD account from an IP identified as being in Israel.

I first verified that it was NOT my current account, then proceeded to change my password on it; then I logged of, was then able to retrieve access to my old account, which still had sufficient information for me to verify that is WAS my old account, rather than someone else's account misdirected to me.
I then changed the password for that account as well, to a different one.

So, basically I have now access to both my old and current account.

I am pasting here the text of the Stem message, that get interesting:

====================================================================
Dear fafhred,

Here is the Steam Guard code you need to login to account fafhred:
(edited out)

This email was generated because of a login attempt from a computer located at 46.116.128.208 (IL). The login attempt included your correct account name and password.

The Steam Guard code is required to complete the login. No one can access your account without also accessing this email.

If you are not attempting to login then please change your Steam password, and consider changing your email password as well to ensure your account security.

If you are unable to access your account then use this account specific recovery link for assistance recovering or self-locking your account.
The Steam Team
https://help.steampowered.com
====================================================================

I have very strong security on my computers, (ZoneAlarm always up to date), and the last time I could access my old account (before today) was several years and 2 computers ago...
This implies that the password can ONLY have been hacked from Steam themselves...

Steam does not provide ANY means to report to them a detected hack, therefore I am placing this report here.
If someone from their security department want any details, I can forward them back the email involved.


AGAIN, this is NOT an issue of retrieving or protecting an account; it is an issue of probable hack of Steam servers a few years back...
If the computer I was using back then had been hacked (extremely unlikely), I would have known about it long ago...


{ССЫЛКА УДАЛЕНА}http://www.whoisip.org/ip-locator tells me that this IP originates from:

Location Engine A >>> 46.116.128.208 >>> Success

City: Tel Aviv
Region: Tel Aviv
Country: Israel
Lat: 32.067001
Long: 34.766998
ISP: undefined

Location Engine B >>> 46.116.128.208 >>> Success

City: Tel Aviv
Region: Tel Aviv
Country: Israel
Lat: 32.0667
Long: 34.7667
ISP: 013 NetVision

Location Engine C >>> 46.116.128.208 >>> Success

City: Lod
Region: HaMerkaz
Country: IL
Lat: 31.9514
Long: 34.8953
ISP: AS1680 013 NetVision Ltd

[cSg|mc-Hotsauce]

1. i can spoof that ip at any time. that has no bearing on this situation.

2. most likely there was a security issue on your end. steam has account information encrypted. you would not be the only one impacted if it was stolen/hacked from steam. thousands of people would be flooding the forums if that were the case.

3. http://www.valvesoftware.com/security/

[76561198147871868]

I already answered this in advance in my post, clearly you did not read through.
This old account must have been hijacked several years ago, not a few days or hours ago.

Thanks for this link, though I am sending them a heads up and a forwarding of the relevant email.

[cSg|mc-Hotsauce]

Автор сообщения: Fafhred

I already answered this in advance in my post, clearly you did not read through.
This old account must have been hijacked several years ago, not a few days or hours ago.

but you did say, "Today, I received an automated email from Steam." this means that the account was being accessed today. they send you the email right away.

[76561198147871868]

Yes, but THIS account had been unavailable to me for several years.
My reading of the situation is that it had been hijacked back then, and that I only retrieved it today due to the current security features at Steam.

I am talking about 2 Steam accounts, the second one having been created after I lost access to first one and was unable to retrieve access to it (no, password retrieval DID NOT work back them, for some unknown reason; it worked today, though).
It was clearly explained in my post...

[Darren]

What did you do with those old 2 computers?

[76561198147871868]

I still have them, just not in use any more due to major faults on both.

[Darren]

Well that removes the possibility that someone got ahold of an old harddrive. I would ask if you know whether you used the password of your previous account on some other site, but I guess since you don't even remember what that password is you wouldn't know the answer.

[76561198147871868]

No, I have different passwords for every single website and applications, and I change them periodically.
I do not use a computer based passwords storage, therefore I occasionally need to rely on password retrieval when I go back to a site I have not been to for years, which was not the case there.

[76561198147871868]

Never received ANY answer at all from Steam so-called support (Yes, I did email them), and it appears that other people are now getting similar issues.
At the time my old account was hijacked, the retrieval feature was NOT working, same as new posters say it is happening to them now (retrieval only worked very recently as my post explained), therefore I do believe the same can happen to someone else now...

[HLCinSC]

Автор сообщения: Fafhred

Never received ANY answer at all from Steam so-called support (Yes, I did email them), and it appears that other people are now getting similar issues.
At the time my old account was hijacked, the retrieval feature was NOT working, same as new posters say it is happening to them now (retrieval only worked very recently as my post explained), therefore I do believe the same can happen to someone else now...

It's been awhile since I have had to use Steam support but from what I remember they don't respond through to emails sent to them. They only respond to tickets submitted to them.

[loganthekid]

I'm getting around 20 attemps a day to get my account they say change email and password but as soon as you do it happens again

[Supafly]

Автор сообщения: darrenpaul999

I'm getting around 20 attemps a day to get my account they say change email and password but as soon as you do it happens again

Once username and password info is on the net it can't be removed. Aslong as they don't have your Guard code they can't get in. Though they shouldn't have a correct password anyway.

Do all of these to secure your account

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey